Lr350 EUVD-2026-16852

Requires authenticated access to Totolik LR350 firmware 9.3.5u.6369_B20220309. Attacker must be logged into the device to access /cgi-bin/cstecgi.cgi and manipulate the ssid parameter in setWiFiGuestCfg function. Remote exploitation requires prior authentication credentials.

Real-world risk assessment reveals moderate-to-high priority requiring attention but not emergency response. The CVSS 7.4 High score reflects maximum impact potential (complete device compromise), but several factors moderate immediate risk. The PR:L requirement means attackers need valid low-privilege credentials to the router's web interface, significantly reducing the attack surface compared to unauthenticated exploits. The publicly available exploit code (E:P in CVSS vector) lowers the skill barrier for exploitation, increasing risk for exposed devices. No CISA KEV listing indicates this is not confirmed as actively exploited in widespread campaigns. The network attack vector (AV:N) means internet-exposed management interfaces are at risk, though best practices dictate admin interfaces should not be internet-facing. SOHO routers like the LR350 often have weak default credentials or poor credential hygiene, which could satisfy the authentication requirement. The vulnerability is automatable once credentials are obtained, and technical impact is total device compromise. Priority depends heavily on deployment context: critical for internet-exposed admin interfaces or networks with compromised credentials, lower priority for properly segmented devices with strong authentication.

An attacker who has obtained or guessed low-privilege credentials to the LR350's web interface (common in SOHO environments with default or weak passwords) navigates to the guest WiFi configuration page. The attacker intercepts the HTTP request to /cgi-bin/cstecgi.cgi and modifies the ssid parameter to contain a carefully crafted payload exceeding 200+ characters, triggering the buffer overflow. The malicious payload overwrites the return address on the stack, redirecting execution to attacker-supplied shellcode that establishes persistent remote access to the router. With publicly available exploit code, even low-skill attackers can automate this attack against internet-exposed router management interfaces discovered through Shodan or similar scanning tools.