Is there a public PoC exploit available for CVE-2026-7633?

Yes, a public proof-of-concept exploit is available for CVE-2026-7633. Prioritise patching immediately. EPSS: 0.1%.

Totolink N300RH CVE-2026-7633

Q: What is the CVSS score of CVE-2026-7633?

CVE-2026-7633 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-26795 MEDIUM

External Control of File Name or Path (CWE-73)

2026-05-02 VulDB

Information Disclosure N300Rh

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 02, 2026 - 15:22 NVD

6.5 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

May 02, 2026 - 15:16 vuln.today

Public exploit code

Analysis Generated

May 02, 2026 - 15:00 vuln.today

EUVD ID Assigned

May 02, 2026 - 14:30 euvd

EUVD-2026-26795

Analysis Generated

May 02, 2026 - 14:30 vuln.today

CVE Published

May 02, 2026 - 14:00 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was identified in Totolink N300RH 6.1c.1353_B20190305. This impacts the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument FileName leads to file inclusion. The attack may be performed from remote. The exploit is publicly available and might be used.

AnalysisAI

External file inclusion in Totolink N300RH firmware 6.1c.1353_B20190305 allows remote unauthenticated attackers to manipulate the FileName parameter in the setUploadSetting function via /cgi-bin/cstecgi.cgi, enabling arbitrary file writes and denial of service. Publicly available exploit code exists, and the vulnerability carries a CVSS score of 6.5 reflecting network-accessible attack vector with low complexity.

Technical ContextAI

The vulnerability exists in the cstecgi.cgi CGI script, a common administrative interface in Totolink routers. The setUploadSetting function fails to properly validate the FileName parameter before using it in file operations, enabling path traversal or file inclusion attacks. CWE-73 (External Control of File Name or Path) describes this root cause class where user-supplied input is used directly in file system operations without sanitization. The affected product is a wireless router (N300RH) running embedded firmware, making it an attractive IoT target. The vulnerability allows attackers to write arbitrary files to the system or include malicious files through improper path handling.

RemediationAI

Vendor patch information is not available in the provided references. Users should immediately check Totolink's official website (https://www.totolink.net/) and support portal for firmware updates addressing CVE-2026-7633. If a patched firmware version is released, apply it immediately via the device's web interface or TFTP recovery method. As a temporary compensating control, restrict network access to the /cgi-bin/cstecgi.cgi endpoint using firewall rules or access control lists - block all external access to the router's administrative interface on port 80/443 unless administration is required, and use only trusted networks for management. Disable UPnP and remote management features if enabled, as they may provide alternative attack vectors. Isolate the router on a separate management VLAN if possible. These mitigations reduce attack surface but do not eliminate the vulnerability; patching is the definitive fix once available.