Totolink N300RH CVE-2026-7747

Exploitation requires the Totolink N300RH router's web management interface (specifically /cgi-bin/cstecgi.cgi endpoint) to be network-accessible to the attacker-this is default configuration when the device is deployed as an internet-facing gateway. No authentication, user interaction, or non-default configuration is necessary (CVSS PR:N/UI:N confirms). The vulnerability exists in the loginauth function during credential processing, meaning it is triggered before successful authentication, making this a pre-auth buffer overflow. Limiting factors: exploitation is constrained to the specific firmware version 3.2.4-B20220812; routers with management interfaces restricted to LAN-only access via firewall rules are not remotely exploitable (though remain vulnerable to local network attackers); successful exploitation requires precise payload construction to reliably control instruction pointer on MIPS/ARM architecture typical of these routers, though public POC availability mitigates this complexity.

Real-world risk is HIGH despite no CISA KEV listing. The CVSS 4.0 score of 8.9 with network vector, no authentication requirement, and low attack complexity represents severe exploitability metrics. Critically, publicly available exploit code exists (confirmed by VulDB and Notion-hosted POC reference), lowering the skill barrier for exploitation. The E:P (Proof-of-concept) metric in CVSS confirms weaponization. However, risk is somewhat contained by the narrow affected scope: only Totolink N300RH version 3.2.4-B20220812, a likely discontinued consumer router model with limited enterprise deployment. Absence from CISA KEV suggests this has not yet been incorporated into widespread attack campaigns, but the combination of unauthenticated remote access, buffer overflow primitive, and public exploit makes this immediately exploitable by opportunistic attackers scanning for vulnerable devices. Organizations should prioritize if these specific Totolink routers are deployed, particularly if management interfaces are internet-accessible. SSVC factors: exploitation is public (confirmed POC), automatable (network-based buffer overflow), technical impact is total system compromise-decision outcome is Act with elevated priority for affected installations.

An attacker performing internet-wide scanning identifies a Totolink N300RH router with default or internet-accessible web management interface on port 80/443. Without requiring credentials, they send a specially crafted HTTP POST request to /cgi-bin/cstecgi.cgi with an oversized Password parameter (demonstrated in the public POC at https://lavender-bicycle-a5a.notion.site/TOTOLINK-N300RH-loginauth_password-34553a41781f80c0ad36f4d95122fd40), triggering the buffer overflow in the loginauth function and executing attacker-controlled shellcode with root privileges, fully compromising the router and enabling network traffic interception, credential harvesting, or pivot attacks into the local network.