Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.4
CVE-2026-7748: Totolink N300RH: Remote Code Execution via File Upload
CVE-2026-7748 · published 6 months ago
Summary
A vulnerability in the Totolink N300RH router's file upload system can be exploited remotely, allowing an attacker to potentially execute malicious code on the device. This could lead to unauthorized access or disruption of the router's functionality. It's recommended that users update their router to the latest version to fix this issue.
Original advisory text
A weakness has been identified in Totolink N300RH 3.2.4-B20220812. Affected by this issue is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Execut...
A weakness has been identified in Totolink N300RH 3.2.4-B20220812. Affected by this issue is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Executing a manipulation of the argument FileName can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-119Buffer Overflow
CWE-120Classic Buffer Overflow
Timeline
Published4 May 2026
Updated4 Nov 2026
First seen4 May 2026
Sources
CVE-2026-7748 · NVD
Track software like this
Free during beta