Is CVE-2026-79912 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79912 being exploited in the wild.

How severe is CVE-2026-79912?

High severity, with a CVSS score of 8.3, published 25 August 2026.

Which products and versions are affected?

TOTOLINK N600r 4.3.0cu.7647_B20210106.

Is there a fix for CVE-2026-79912?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-79912 attacked?

It is attacked over the network.

Am I affected by CVE-2026-79912?

Check whether you run TOTOLINK N600r at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79912: TOTOLINK N600R command injection in cstecgi.cgi

CVE-2026-79912 · Severity: high · CVSS 8.3 · Published 2026-08-25

TOTOLINK N600R is a wireless router used to provide network connectivity in homes and small offices. A vulnerability in its web configuration interface allows an attacker to inject arbitrary commands by manipulating the NTP server parameter, potentially enabling remote code execution and complete control of the device.

Technologies: TOTOLINK N600r. Vendors: TOTOLINK.

Quick answers

Is CVE-2026-79912 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79912 being exploited in the wild.
How severe is CVE-2026-79912?: High severity, with a CVSS score of 8.3, published 25 August 2026.
Which products and versions are affected?: TOTOLINK N600r 4.3.0cu.7647_B20210106.
Is there a fix for CVE-2026-79912?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-79912 attacked?: It is attacked over the network.
Am I affected by CVE-2026-79912?: Check whether you run TOTOLINK N600r at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a command injection flaw in the getCurrentTime function of /cgi-bin/cstecgi.cgi in TOTOLINK N600R firmware version 4.3.0cu.7647_B20210106. The ntp_server parameter is passed unsanitized to a shell command (popen), allowing an attacker to inject arbitrary OS commands. The attack is network-accessible with no authentication required. An attacker can achieve remote code execution with the privileges of the web server process, potentially gaining full device compromise. No patch information is currently available.

Affected products

TOTOLINK N600R 4.3.0cu.7647_B20210106

Timeline

2026-08-25: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.