CVE Intelligence
Analysis AI-assisted

CVE-2026-7747: Totolink N300RH buffer overflow in cstecgi.cgi loginauth

VulDB reports a buffer overflow in the loginauth function of /cgi-bin/cstecgi.cgi on the Totolink N300RH running version 3.2.4-B20220812. Manipulating the Password argument can be triggered remotely, and the record states that a public exploit has been released. No fixed version is listed, and the record shows no CISA KEV listing.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

VulDB published CVE-2026-7747, a buffer overflow (CWE-119) in the loginauth function of /cgi-bin/cstecgi.cgi, part of the Parameter Handler component of the Totolink N300RH, version 3.2.4-B20220812. The record identifies manipulation of the Password argument as the trigger. See the VulDB entry and the NVD record.

Impact

  • VulDB assigns a CVSS 3.1 base score of 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • The record states the attack can be initiated remotely and gives an SSVC technical impact of total.
  • The exact consequences depend on device configuration and firmware details that the sources do not describe.

Affected products and versions

  • Totolink N300RH, version 3.2.4-B20220812 is the only version listed in the record.
  • No fixed version is listed. This does not mean no fix exists; the remediation status is unknown from the available data.

Exploitation status

  • The record states that an exploit has been released to the public and may be used for attacks.
  • The record shows no CISA KEV listing. No confirmed active exploitation is reported in the sources consulted.
  • EPSS is recorded at 0.0102 (about 1 percent) with a percentile of 0.62467. SSVC exploitation is marked as proof of concept and automatable as yes.

Remediation and mitigation

  • Inventory Totolink N300RH devices and confirm whether any run the affected firmware.
  • Check the Totolink website for firmware updates and apply any vendor fix that becomes available.
  • Do not expose the device web management interface to the internet. Place it behind a firewall or VPN and limit administrative access to trusted hosts.
  • Change default credentials and review administrative accounts.
  • If the device cannot be updated or isolated, plan its replacement with a supported model.

Detection guidance

  • Review web server and device logs for unusual or malformed requests to cstecgi.cgi, particularly login-related requests with abnormally long input.
  • Monitor for unexpected reboots, crashes or configuration changes on the device.
  • Watch for inbound connections from untrusted networks to the device management ports.

Limitations of the available information

  • The record does not reference a vendor advisory, firmware fix or patched version.
  • The sources do not describe real-world incidents or confirm the exploit's effectiveness against specific firmware builds.
  • The EPSS date in the record is later than the publication date, so the scoring timing is not verified.

Frequently asked questions

Is CVE-2026-7747 being actively exploited?

The record shows no CISA KEV listing, and no confirmed active exploitation is reported in the sources consulted. The record does state that a public exploit has been released.

Which devices are affected?

The record lists the Totolink N300RH with version 3.2.4-B20220812. No other versions or fixed versions are listed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.