CVE-2026-10187 in N300RH
Summary
by MITRE • 05/31/2026
A vulnerability was detected in Totolink N300RH 6.1c.1353_B20190305. Affected by this issue is the function setWiFiBasicConfig of the file wireless.so of the component Web Management Interface. Performing a manipulation of the argument KeyStr results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/31/2026
The vulnerability in Totolink N300RH router firmware version 6.1c.1353_B20190305 represents a critical stack-based buffer overflow condition within the web management interface component. This issue specifically affects the setWiFiBasicConfig function located in the wireless.so library, which handles wireless configuration parameters through the web interface. The vulnerability arises from insufficient input validation when processing the KeyStr argument, allowing attackers to manipulate this parameter in a manner that exceeds the allocated buffer space on the stack. The exploitation of this flaw enables remote code execution capabilities, making it particularly dangerous as it can be leveraged without physical access to the device.
The technical implementation of this vulnerability demonstrates a classic stack buffer overflow scenario where the KeyStr parameter lacks proper bounds checking before being copied into a fixed-size buffer. This type of vulnerability falls under CWE-121 Stack-based Buffer Overflow, which is classified as a high-severity issue in the Common Weakness Enumeration catalog. The attack vector is remote, meaning an attacker can exploit this vulnerability from any location on the network without requiring local access to the device. The public availability of exploits for this vulnerability significantly increases the risk profile, as malicious actors can readily deploy automated attack tools against affected devices. This vulnerability directly maps to several techniques described in the MITRE ATT&CK framework, particularly those related to exploitation of remote services and privilege escalation through command execution.
The operational impact of this vulnerability extends beyond simple unauthorized access to encompass complete device compromise and potential network infiltration. Once exploited, attackers can gain root-level access to the router's operating system, enabling them to modify network configurations, install persistent backdoors, or use the device as a pivot point for attacking other systems within the local network. The web management interface serves as a primary attack surface, and the fact that this vulnerability affects the wireless configuration component means that attackers can potentially disrupt network communications or establish unauthorized wireless access points. Organizations relying on this router model face significant risk of data breaches, man-in-the-middle attacks, and potential use as part of botnet operations. The vulnerability's remote exploitability means that even devices behind firewalls or NAT configurations remain at risk, as the web interface typically requires internet-accessible ports to be functional.
Mitigation strategies for this vulnerability should include immediate firmware updates from the vendor, as the manufacturer has likely released patches addressing this specific buffer overflow condition. Network segmentation and access control measures can help limit the potential impact if devices remain unpatched, while monitoring for suspicious network activity and unauthorized configuration changes can aid in early detection of exploitation attempts. Security professionals should implement regular vulnerability scanning procedures targeting network devices to identify other potentially affected equipment. The implementation of network intrusion detection systems can help monitor for known exploit patterns associated with this vulnerability class, while maintaining updated threat intelligence feeds ensures awareness of emerging attack vectors. Additionally, organizations should consider implementing network access control measures that restrict web interface access to authorized administrative networks, reducing the attack surface for this particular vulnerability.