Totolink N300RH CVE-2026-7748

Requires valid low-privilege authenticated access (PR:L) to the Totolink N300RH web administration interface - specifically, an attacker must possess valid admin credentials to send POST requests to /cgi-bin/cstecgi.cgi. The vulnerability is exploitable against default configurations of firmware version 3.2.4-B20220812 once authentication is achieved. No additional feature enablement or non-default configuration is required beyond the standard web interface being accessible. Exploitation is limited by credential requirements - devices with default/weak passwords face significantly higher risk, especially if admin interfaces are exposed to WAN/internet. Devices with strong unique credentials and admin access restricted to LAN-only are substantially harder to exploit despite the network attack vector (AV:N), as attackers must first compromise credentials or achieve local network position.

CVSS 4.0 vector shows network attack vector (AV:N), low complexity (AC:L), no attack complexity (AT:N), requiring low privileges (PR:L), with high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H) but no impact to subsequent systems (SC:N/SI:N/SA:N). The Exploit maturity indicator E:P confirms proof-of-concept exists. Public exploit code is documented on Notion per references. However, this vulnerability requires authentication (PR:L) to the router's admin interface, significantly limiting attack surface compared to unauthenticated RCE. No EPSS score provided in input data. Not present in CISA KEV, indicating no confirmed widespread exploitation despite public POC availability. Real-world risk is moderate: while the vulnerability enables complete device compromise, exploitation requires prior credential access (default credentials, credential stuffing, or phishing). For internet-facing routers with weak/default credentials, risk escalates substantially. Organizations should prioritize if Totolink N300RH devices are deployed, especially in edge/remote office scenarios where admin interfaces may be exposed.

An attacker who has obtained credentials to the Totolink N300RH admin interface (via default credentials, credential reuse, or prior compromise) authenticates to the web management portal over the network. Using the publicly available exploit code documented on Notion, the attacker sends a crafted POST request to /cgi-bin/cstecgi.cgi targeting the setUpgradeFW function with a maliciously oversized FileName parameter designed to overflow the stack buffer. The overflow overwrites the return address, redirecting execution to attacker-controlled shellcode that executes with root privileges, granting complete control over the router to establish persistence, intercept traffic, or pivot to internal network devices.