Totolink N300RH EUVD-2026-33509

The attacker must be able to reach the Totolink N300RH Web Management Interface over the network and submit a request to the setWiFiBasicConfig handler with a manipulated KeyStr argument; CVSS PR:N indicates no authentication is required by the vulnerable code path, and UI:N means no victim interaction is needed. Exploitation is limited to devices running firmware 6.1c.1353_B20190305 (and likely sibling builds sharing the same wireless.so), and is practically constrained by whether the Web Management Interface is exposed only on the LAN (default) versus also on the WAN - internet-facing exploitation depends on operators having enabled remote administration or on the attacker already having a LAN foothold.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) describes a network-reachable, low-complexity, unauthenticated attack with high triad impact, yielding the 8.9 base score, and E:P confirms a proof-of-concept exists. No EPSS score was provided, and the CVE is not listed in CISA KEV - so although a public exploit exists, there is no confirmed active mass exploitation. The real-world risk hinges on exposure of the Web Management Interface: by default, vendor-supplied SOHO routers expose admin UIs only on the LAN, which would substantially reduce attack surface despite the AV:N rating; however, many Totolink units have historically been targeted by Mirai-class botnets when WAN-side admin is enabled or when LAN-side attackers (malware, guest devices) reach the management plane. Treat as high priority for any N300RH operator, but realistic widespread internet-facing exploitation is bounded by WAN management exposure.

An attacker with network reach to the router's Web Management Interface (e.g., a malicious LAN client, a compromised IoT device on the same network, or an internet attacker against units with WAN admin exposed) sends a crafted HTTP request to the setWiFiBasicConfig endpoint with an oversized KeyStr parameter. The overflow corrupts the saved return address on the stack within wireless.so, allowing the attacker to redirect execution and run arbitrary code as the web server process - typically root on embedded routers - yielding full device takeover suitable for traffic interception, DNS hijacking, or botnet enrollment. Publicly available exploit code lowers the skill barrier for opportunistic actors.