Totolink N300RH CVE-2026-9543

The attacker must have network reachability to the router's Web Management Interface (TCP port serving /cgi-bin/cstecgi.cgi) and the target must be running firmware 6.1c.1353_B20190305 on a Totolink N300RH. Per CVSS PR:N and UI:N, no authentication and no user interaction are required - exploitation is unauthenticated against the setPasswordCfg endpoint. The principal limiting factor is exposure: by default most SOHO routers restrict the management interface to the LAN, so internet-wide exploitation requires that the operator has explicitly enabled WAN-side remote administration; otherwise exploitation requires a foothold on the LAN (a compromised host, malicious Wi-Fi client, or insider). No special configuration of the vulnerable feature itself is needed - the password-change CGI handler is present in the default firmware.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H yields a score of 8.9, reflecting that exploitation requires only network reachability to the management interface with no privileges or user interaction, and yields total compromise of confidentiality, integrity, and availability. SSVC corroborates this with Exploitation=poc, Automatable=yes, and Technical Impact=total, indicating a worm-friendly primitive. However, the EPSS probability of 0.20% (42nd percentile) and absence from CISA KEV suggest that while the bug is trivially exploitable and a POC is published on GitHub, broad opportunistic exploitation has not yet been observed - consistent with the limited internet exposure typical of consumer routers whose admin interfaces are usually LAN-only. Real-world risk is high for devices with WAN-side management enabled and for internal attackers on the LAN; lower for default WAN-blocked deployments. No conflicting signals were identified in the available data.

An attacker reachable to the router's web management interface - either across the internet if remote management is enabled, or from any host on the LAN - sends a single crafted HTTP POST request to /cgi-bin/cstecgi.cgi invoking setPasswordCfg with an admpass value containing shell metacharacters such as ; or backticks. The injected command executes as the web server process (typically root on embedded Linux), allowing the attacker to drop a backdoor, pivot into the internal network, or enlist the device into a botnet. A public POC is available at https://github.com/A1ester/TOTOLINK-N300RH-Command-Injection, lowering the skill barrier substantially.