Totolink N300RH EUVD-2026-26941

Attacker must possess valid authentication credentials (username and password) for the Totolink N300RH administrative web interface, as indicated by CVSS PR:L (low privileges required). The router's web management interface must be network-accessible to the attacker - either exposed to the internet via WAN-side management (non-default configuration on most routers) or accessible from a compromised device on the LAN side. Default configurations typically restrict admin access to LAN only, which would require the attacker to first compromise a device on the internal network. The specific vulnerable firmware version 3.2.4-B20220812 must be running. No special router features need to be enabled beyond the standard web-based configuration interface. Limiting factors: authentication requirement prevents fully unauthenticated remote exploitation; exploitation from internet requires non-default remote management enabled; attack complexity is low (AC:L) once credentials are obtained, requiring no race conditions or specialized timing.

Real-world risk is MODERATE despite the 7.4 CVSS score due to required authentication (PR:L) and the limited deployment scope of this specific router model. The CVSS 4.0 vector shows network-accessible attack (AV:N) with low complexity (AC:L) requiring low-privilege authentication but no user interaction (UI:N), leading to high impact on device confidentiality, integrity, and availability (VC:H/VI:H/VA:H) with no scope change (SC:N/SI:N/SA:N). The E:P modifier confirms proof-of-concept exploit exists publicly. However, EPSS data is not provided, CISA KEV status is absent (suggesting no confirmed widespread exploitation), and SSVC indicators point to lower priority: exploitation requires authenticated access to router admin interface, attack is automatable post-authentication but requires credential compromise first, and technical impact is limited to individual router devices rather than enterprise-scale systems. The primary risk is to environments where router credentials have been compromised through phishing, default passwords, or credential reuse. For organizations using this router model with strong credential hygiene, risk is significantly lower than raw CVSS suggests. Key missing data: EPSS probability score, confirmation of whether default credentials exist, and vendor's security response timeline.

An attacker who has obtained valid credentials for the Totolink N300RH admin interface (through phishing, default password exploitation, or credential stuffing) logs into the router's web management panel remotely. The attacker crafts a malicious HTTP POST request to /cgi-bin/cstecgi.cgi targeting the setWanConfig function, inserting an oversized string (exceeding buffer limits) into the priDns parameter that contains shellcode. The buffer overflow overwrites the stack return address, redirecting execution to attacker-controlled code running with root privileges on the router, allowing installation of persistent backdoors, DNS hijacking for man-in-the-middle attacks, or pivot points into the internal network. Public exploit code documented at lavender-bicycle-a5a.notion.site demonstrates the exact payload structure required.