Totolink N300RT CVE-2026-7218

Exploitation requires authenticated administrative access to the Totolink N300RT web interface (CVSS PR:H). The attacker must reach the router's HTTP/HTTPS management interface over the network (AV:N), which depends on deployment configuration: routers with internet-facing admin panels (common in default configurations or UPnP-enabled setups) are directly exploitable remotely, while devices with admin interfaces restricted to local LAN require the attacker to first compromise a host on the internal network. The vulnerable /boafrm/formWsc endpoint is part of standard WPS configuration functionality and enabled by default in firmware 3.4.0-B20250430. No special non-default settings are required beyond having the web interface active. Network access alone is insufficient - valid admin credentials are mandatory, making password strength the primary limiting factor against exploitation.

Real-world risk is MODERATE-HIGH despite 7.3 CVSS score. The PR:H (high privileges required) constraint significantly reduces attack surface - exploitation demands compromised admin credentials first. However, several factors elevate concern: (1) Public POC on GitHub enables script-kiddie attacks against routers with weak/default admin passwords, (2) AC:L (low attack complexity) means exploitation is reliable once credentials obtained, (3) VC:H/VI:H/VA:H indicates complete system compromise (confidentiality, integrity, availability), (4) Home routers like N300RT frequently retain default credentials or use weak passwords, lowering the privilege requirement barrier in practice. Absence from CISA KEV and lack of EPSS data suggests exploitation not yet automated or widespread, but the POC availability creates a ticking clock for bulk scanning campaigns targeting exposed admin interfaces. Priority depends on deployment context: HIGH for internet-facing admin panels with credential stuffing risk, MODERATE for properly segmented management networks with strong authentication.

An attacker first obtains Totolink N300RT admin credentials via credential stuffing, brute force against weak passwords, or phishing targeting the device owner. With authenticated access to the web interface, the attacker sends a specially crafted HTTP POST request to /boafrm/formWsc containing an oversized localPin parameter (e.g., 500+ byte payload with embedded shellcode). The is_cmd_string_valid function in libapmib.so fails to validate input length, overwriting the stack return address. Upon function return, execution redirects to attacker-controlled shellcode, achieving arbitrary code execution as the web server process (likely root), enabling firmware backdooring, credential harvesting, or pivot to internal network.