Vulnerabilidades do Totolink N300RH

CVE-2026-10187 Crítica · 9.8 CWE-119 31/05/2026

Totolink N300RH Web Management wireless.so setWiFiBasicConfig stack-based overflow

A vulnerability was detected in Totolink N300RH 6.1c.1353_B20190305. Affected by this issue is the function setWiFiBasicConfig of the file wireless.so of the component Web Management Interface. Performing a manipulation of the argument KeyStr results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.

CVE-2026-9543 Crítica · 9.8 CWE-77 26/05/2026

Injeção de Comando no Sistema Operacional em setPasswordCfg (cstecgi.cgi) da Interface Web do Totolink N300RH

Foi identificada uma vulnerabilidade no Totolink N300RH 6.1c.1353_B20190305. Afetada está a função setPasswordCfg do arquivo /cgi-bin/cstecgi.cgi do componente Web Management Interface. Tal manipulação do argumento admpass leva a injeção de comando no sistema operacional. O ataque pode ser executado remotamente. O exploit foi divulgado ao público e pode ser utilizado.

CVE-2026-7750 Alta · 8.8 CWE-119 04/05/2026

Totolink N300RH POST Request cstecgi.cgi setMacFilterRules buffer overflow

A vulnerability was detected in Totolink N300RH 3.2.4-B20220812. This vulnerability affects the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument mac_address results in buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.

CVE-2026-7749 Alta · 8.8 CWE-119 04/05/2026

Totolink N300RH POST Request cstecgi.cgi setWanConfig buffer overflow

A security vulnerability has been detected in Totolink N300RH 3.2.4-B20220812. This affects the function setWanConfig of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument priDns leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-7748 Alta · 8.8 CWE-119 04/05/2026

Totolink N300RH POST Request cstecgi.cgi setUpgradeFW buffer overflow

A weakness has been identified in Totolink N300RH 3.2.4-B20220812. Affected by this issue is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Executing a manipulation of the argument FileName can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-7747 Crítica · 9.8 CWE-119 04/05/2026

Estouro de buffer no loginauth do cstecgi.cgi do Totolink N300RH (CVE-2026-7747)

Foi identificada uma falha de segurança no Totolink N300RH 3.2.4-B20220812. Afetada por esta vulnerabilidade está a função loginauth do arquivo /cgi-bin/cstecgi.cgi do componente Parameter Handler. A manipulação do argumento Password resulta em estouro de buffer. O ataque pode ser iniciado remotamente. O exploit foi divulgado publicamente e pode ser usado em ataques.

CVE-2026-7633 Média · 6.5 CWE-73 02/05/2026

Totolink N300RH cstecgi.cgi setUploadSetting file inclusion

A vulnerability was identified in Totolink N300RH 6.1c.1353_B20190305. This impacts the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument FileName leads to file inclusion. The attack may be performed from remote. The exploit is publicly available and might be used.

CVE-2026-6158 Alta · 7.3 CWE-77 13/04/2026

Totolink N300RH upgrade.so setUpgradeUboot os command injection

A flaw has been found in Totolink N300RH 6.1c.1353_B20190305. Affected is the function setUpgradeUboot of the file upgrade.so. This manipulation of the argument FileName causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

CVE-2026-3696 Crítica · 9.8 CWE-78 07/03/2026

Totolink N300RH CGI cstecgi.cgi setWiFiWpsConfig os command injection

A vulnerability was found in Totolink N300RH 6..1c.1353_B20190305. The affected element is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used.

CVE-2026-3301 Crítica · 9.8 CWE-78 27/02/2026

Totolink N300RH Web Management cstecgi.cgi setWebWlanIdx os command injection

A security flaw has been discovered in Totolink N300RH 6.1c.1353_B20190305. Affected by this vulnerability is the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument webWlanIdx results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.