Totolink N300RH CVE-2026-7633

Remote unauthenticated access to the /cgi-bin/cstecgi.cgi endpoint is the only requirement. The setUploadSetting function does not enforce authentication (CVSS PR:N) and accepts requests over HTTP from any network-reachable source (AV:N/AC:L). No special configuration, firmware feature enablement, or user interaction is needed. The vulnerability exists in the default administrative interface of the N300RH and requires no additional conditions. Limiting factors include: (1) the attacker must have network connectivity to the router's web interface, (2) the router must be running vulnerable firmware 6.1c.1353_B20190305 or similar unpatched versions, and (3) firewall rules or network segmentation may prevent external access in properly managed networks. Default deployments with internet-exposed administrative interfaces are at maximum risk.

CVSS 6.5 (AV:N/AC:L/PR:N/UI:N) indicates network-accessible, unauthenticated exploitation with low attack complexity - a significant threat surface for exposed routers. EPSS data is not provided, limiting quantitative exploitation probability assessment. However, the combination of publicly available exploit code, remote unauthenticated access (PR:N), and no user interaction requirement (UI:N) creates a high real-world risk for unpatched devices. The vulnerability does not directly enable remote code execution (Impact shows Integrity:L, Availability:L, Confidentiality:None), but file-write capabilities can facilitate secondary attacks such as configuration modification, malware staging, or denial of service. The absence of CVSS Scope:C (not affecting other systems) and the RL:X/RC:R vector modifiers suggest moderate reliability. This is a genuine priority for any environment where Totolink N300RH routers are deployed, particularly in IoT or edge network segments.

An attacker remotely accesses the unpatched N300RH router's /cgi-bin/cstecgi.cgi endpoint and crafts a malicious HTTP request with a path-traversal payload in the FileName parameter (e.g., FileName=../../etc/init.d/startup_script.sh). The setUploadSetting function processes this input without validation and writes or includes the attacker-supplied file to a critical system location, enabling persistent command execution or router configuration tampering. The publicly available POC on GitHub demonstrates this attack chain and can be executed by any attacker with network access to the router.