CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Oct 30, 2026, 1:10 AM ET)

What this means for you

This week: 3,356 CVEs published, 233 critical, and 2 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,356; Show in the list
Critical, last 7 days: 233; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,764; Show in the list

Showing CVEs that name the product totolink:nr1800x_firmware. Show all products

12 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2025-60688	Medium 6.5	A stack buffer overflow vulnerability exists in the ToToLink LR1200GB (V9.1.0u.6619_B20230130) and NR1800X (V9.1.0u.6681_B20230703) Router firmware within the cstecgi.cgi binary (setDefResponse funct… Assigned by mitre	Nov 12, 2025
CVE-2025-60686	Medium 5.1	A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers (A720R V4.1.5cu.614_B20230630, LR1200GB V9.1.0u.6619_B20230130, and NR1800X V… Assigned by mitre	Nov 12, 2025
CVE-2025-60684	Medium 6.5	A stack buffer overflow vulnerability exists in the ToToLink LR1200GB (V9.1.0u.6619_B20230130) and NR1800X (V9.1.0u.6681_B20230703) Router firmware within the cstecgi.cgi binary (sub_42F32C function). Assigned by mitre	Nov 12, 2025
CVE-2026-1326	Medium 6.3	Totolink NR1800X POST Request cstecgi.cgi setWanCfg command injection Assigned by VulDB	Jan 22, 2026
CVE-2026-1327	Medium 6.3	Totolink NR1800X POST Request cstecgi.cgi setTracerouteCfg command injection Assigned by VulDB	Jan 22, 2026
CVE-2026-1328	High 8.8	Totolink NR1800X POST Request cstecgi.cgi setWizardCfg buffer overflow Assigned by VulDB	Jan 22, 2026
CVE-2026-5030	Medium 6.3	Totolink NR1800X Telnet Service cstecgi.cgi NTPSyncWithHost command injection Assigned by VulDB	Mar 28, 2026
CVE-2026-7546	Critical 9.8	Totolink NR1800X lighttpd find_host_ip stack-based overflow Assigned by VulDB	Apr 30, 2026
CVE-2026-7548	High 8.8	Totolink NR1800X cstecgi.cgi sub_41A68C command injection Assigned by VulDB	Apr 30, 2026
CVE-2026-15701	Critical 9.8	Totolink NR1800X lighttpd formLogout.htm Form_Logout stack-based overflow Assigned by VulDB	Jul 14, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.