Which versions of Totolink N300RH are affected by CVE-2026-10187?

Totolik N300RH routers (firmware 6.1c.1353_B20190305) contain a critical stack-based buffer overflow exploitable without authentication via the web management interface, allowing complete network…

Is there a public PoC exploit available for CVE-2026-10187?

Yes, a public proof-of-concept exploit is available for CVE-2026-10187. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-10187?

Within 24 hours: Conduct inventory of all Totolink N300RH routers in operation and identify firmware versions. Within 7 days: Disable public internet access to the web management interface and implement IP-based access controls (restrict to management VLANs only). Within 30 days: Develop replacement or alternative device strategy (vendor has not issued patches for this model); if continued use is unavoidable, isolate the device on a restricted segment and implement detailed monitoring.

Totolink N300RH CVE-2026-10187

Q: What is the CVSS score of CVE-2026-10187?

CVE-2026-10187 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-33509 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-31 VulDB

GHSA-f783-rqc9-65mx

Buffer Overflow Stack Overflow N300Rh

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 31, 2026 - 15:29 vuln.today

v3 (cvss_changed)

Analysis Updated

May 31, 2026 - 15:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 31, 2026 - 15:22 vuln.today

cvss_changed

Severity Changed

May 31, 2026 - 15:22 NVD

CRITICAL HIGH

CVSS changed

May 31, 2026 - 15:22 NVD

9.8 (CRITICAL) 8.9 (HIGH)

Analysis Generated

May 31, 2026 - 15:20 vuln.today

DescriptionCVE.org

A vulnerability was detected in Totolink N300RH 6.1c.1353_B20190305. Affected by this issue is the function setWiFiBasicConfig of the file wireless.so of the component Web Management Interface. Performing a manipulation of the argument KeyStr results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.

AnalysisAI

Stack-based buffer overflow in the Totolink N300RH router (firmware 6.1c.1353_B20190305) allows remote attackers to corrupt memory via the KeyStr argument processed by the setWiFiBasicConfig function in wireless.so, reachable through the Web Management Interface. Publicly available exploit code exists, and the CVSS 4.0 vector indicates network-reachable, unauthenticated exploitation with high impact to confidentiality, integrity, and availability. No CISA KEV listing has been published, so exploitation is not confirmed in the wild despite the public PoC.

Technical ContextAI

The affected device is a SOHO wireless router whose web administration interface dispatches configuration requests into native shared libraries - here, wireless.so. The setWiFiBasicConfig handler copies the user-supplied KeyStr parameter (the Wi-Fi key/passphrase value) into a fixed-size stack buffer without proper bounds checking, classic CWE-121 (Stack-based Buffer Overflow). On embedded MIPS/ARM router platforms running BusyBox/Linux without modern stack protections (canaries, ASLR, NX often weak or absent), such overflows commonly enable control-flow hijacking. CPE cpe:2.3:a:totolink:n300rh:*:*:*:*:*:*:*:* indicates all builds of the N300RH product line that ship this firmware lineage are implicated.

RemediationAI

No vendor-released patch identified at time of analysis - VulDB references and the Totolink product page (https://www.totolink.net/) do not list a fixed firmware build, so operators should monitor Totolink's support pages for an updated firmware release superseding 6.1c.1353_B20190305 and apply it as soon as available. Until a patch ships, restrict access to the Web Management Interface: disable remote/WAN-side administration entirely (most impactful mitigation, trade-off is loss of off-LAN management), bind the admin UI to a management VLAN or specific trusted LAN IPs via ACLs (trade-off: configuration complexity and potential lockout if misapplied), and change the default admin password to limit chained abuse if any partial authentication check is reached. As a stronger compensating control where feasible, replace the device with a currently supported model, since the affected firmware lineage dates to 2019 and the N300RH has limited vendor maintenance.