EUVD-2026-21851
GHSA-3cm3-qfjh-c5x9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request
-
DeliveryInject OS command in FileName parameter
-
ExploitTrigger setUpgradeUboot function
-
ExecutionExecute arbitrary shell command
-
ImpactAchieve remote code execution on router
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents high real-world risk despite the moderate CVSS 6.9 score. The CVSS vector confirms network-accessible attack vector (AV:N) with no authentication requirements (PR:N), low attack complexity (AC:L), and exploitation deemed probable (E:P). The confidentiality and integrity impacts are limited per the vector (VC:L, VI:L), but this assessment appears conservative for an OS command injection on a router device-actual impact could include full device compromise, persistence, lateral network movement, or denial of service. The presence of publicly available proof-of-concept code significantly lowers the barrier to exploitation, and the Totolink N300RH is a consumer-grade wireless router widely deployed in home and small business networks. No evidence of active CISA KEV listing is present in the input data, but the published POC and the age of this firmware (2019 build date) suggest this has been known and exploitable for years. Organizations must prioritize patching devices still running this firmware version, particularly given that routers are often trusted network boundary devices. |
| Exploit ScenarioDerived | An unauthenticated attacker on the internet sends a specially crafted HTTP request to the Totolink N300RH router's firmware upgrade endpoint, injecting shell commands into the FileName parameter (for example, setting FileName to a value like "file.bin; cat /etc/passwd #"). The vulnerable setUpgradeUboot function executes this parameter as part of an OS command without sanitization, causing the injected commands to execute on the router with the privileges of the firmware process. The attacker gains remote code execution and can read sensitive files, modify router configuration, establish persistence, or use the compromised router as a pivot point into the internal network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 13, 2026
Remote code execution in Totolink N300RH firmware 6.1c.1353_B20190305 allows unauthenticated network attackers to execute arbitrary OS commands via command injection in the FileName parameter of the setUpgradeUboot function in upgrade.so. Publicly available exploit code exists for this vulnerability, which carries a CVSS 6.9 score reflecting network-accessible attack vector with low complexity and no authentication requirements.
RemediationAI
Contact Totolink for current firmware updates for the N300RH model, as patched firmware versions should be available from https://www.totolink.net/. Upgrade the device to the latest available firmware release, which should address the command injection flaw in the setUpgradeUboot function. As an interim mitigation, restrict network access to the router's web management interface and firmware upgrade endpoints using firewall rules or local network segmentation, and consider disabling the upgrade function entirely if not actively needed. For organizations with multiple N300RH devices, implement inventory control to identify and remediate all affected units before they can be exploited.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the upgrade.so library within the Totolink N300RH router firmware, specifically in the setUpgradeUboot function that handles firmware upgrade operations. The flaw is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning the function fails to properly sanitize or validate the FileName parameter before passing it to OS command execution routines. This allows an attacker to inject shell metacharacters or command sequences into what should be a filename, causing the underlying shell to interpret and execute injected commands with the privileges of the firmware process. The affected CPE is cpe:2.3:a:totolink:n300rh:*:*:*:*:*:*:*:*, indicating all versions of the N300RH product line are potentially affected, with confirmed vulnerability in firmware version 6.1c.1353_B20190305.
Know when N300Rh gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A flaw has been found in Totolink N300RH 6.1c.1353_B20190305. Affected is the function setUpgradeUboot of the file upgrade.so. This manipulation of the argument FileName causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
OS command injection in the Totolink N300RH router (firmware 6.1c.1353_B20190305) allows remote unauthenticated attacker
Stack-based buffer overflow in the Totolink N300RH router (firmware 6.1c.1353_B20190305) allows remote attackers to corr
Remote unauthenticated attackers can execute arbitrary code on Totolink N300RH routers version 3.2.4-B20220812 by sendin
Remote authenticated attackers can execute arbitrary code on Totolink N300RH 3.2.4-B20220812 routers via buffer overflow
Buffer overflow in Totolink N300RH router firmware 3.2.4-B20220812 allows authenticated remote attackers to achieve comp
Buffer overflow in Totolink N300RH router firmware 3.2.4-B20220812 enables authenticated remote attackers to achieve cod
External file inclusion in Totolink N300RH firmware 6.1c.1353_B20190305 allows remote unauthenticated attackers to manip
Exploit-DB