CVE-2026-7747
Published: 04 May 2026
Description
A security flaw has been discovered in Totolink N300RH 3.2.4-B20220812. Affected by this vulnerability is the function loginauth of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. Performing a manipulation of the argument Password results in buffer overflow. The attack…
more
can be initiated remotely. The exploit has been released to the public and may be used for attacks.
Mitigating Controls (NIST 800-53 r5)AI
Requires timely flaw remediation through firmware updates to eliminate the buffer overflow in the loginauth function.
Mandates validation of the Password argument to block malformed inputs that trigger the buffer overflow.
Deploys memory protections such as non-executable stacks to mitigate successful exploitation of the buffer overflow for code execution.
Security SummaryAI
CVE-2026-7747 is a buffer overflow vulnerability affecting the Totolink N300RH router running firmware version 3.2.4-B20220812. The flaw resides in the loginauth function of the /cgi-bin/cstecgi.cgi file within the Parameter Handler component, where manipulation of the Password argument triggers the overflow. Published on 2026-05-04, it is associated with CWE-119 and CWE-120 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical.
The vulnerability enables remote exploitation without authentication or user interaction. Attackers can send crafted requests over the network to the affected component, potentially leading to arbitrary code execution, data compromise, or denial of service, with high impacts on confidentiality, integrity, and availability.
Advisories referenced in VulDB entries (vuldb.com/vuln/360922 and related pages) document the issue and note that a public exploit has been released, available via a Notion site detailing the loginauth password manipulation. The vendor site at totolink.net should be consulted for any firmware patches or updates.
The public availability of the exploit heightens the risk of widespread attacks against unpatched Totolink N300RH devices.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in unauthenticated public CGI endpoint (loginauth/Password) on network device web interface directly enables remote exploitation of public-facing application (T1190) leading to arbitrary code execution via Unix shell (T1059.004).