CVE-2026-7748
Totolink N300RH POST Request cstecgi.cgi setUpgradeFW buffer overflow
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
A weakness has been identified in Totolink N300RH 3.2.4-B20220812. Affected by this issue is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Executing a manipulation of the argument FileName can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
| CWE | CWE-120 CWE-119 |
| Vendor | totolink |
| Product | n300rh |
| Published | May 4, 2026 |
| Last Updated | May 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for totolink n300rh
Be the first to know when new high vulnerabilities affecting totolink n300rh are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Totolink / N300RH
3.2.4-B20220812
References
vuldb.com: https://vuldb.com/vuln/360923 vuldb.com: https://vuldb.com/vuln/360923/cti vuldb.com: https://vuldb.com/submit/807202 lavender-bicycle-a5a.notion.site: https://lavender-bicycle-a5a.notion.site/TOTOLINK-N300RH-setUpgradeFW-34553a41781f80abb1d1c627d7ff4329?pvs=73 totolink.net: https://www.totolink.net/
Credits
🔍 wxhwxhwxh_mie (VulDB User)