CVE-2026-7747 in N300RH
Summary
by MITRE • 05/04/2026
A security flaw has been discovered in Totolink N300RH 3.2.4-B20220812. Affected by this vulnerability is the function loginauth of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. Performing a manipulation of the argument Password results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/10/2026
The vulnerability identified in Totolink N300RH router firmware version 3.2.4-B20220812 represents a critical buffer overflow condition within the web-based management interface. This flaw exists in the Parameter Handler component located at /cgi-bin/cstecgi.cgi and specifically affects the loginauth function. The vulnerability manifests when an attacker manipulates the Password argument parameter, causing memory corruption that can lead to arbitrary code execution or system compromise. The remote exploitability of this vulnerability means that attackers can leverage this flaw without requiring physical access to the device, making it particularly dangerous for networked environments.
This buffer overflow vulnerability directly maps to CWE-121 Stack-based Buffer Overflow, which occurs when a program writes data beyond the boundaries of a fixed-length buffer allocated on the stack. The attack vector through the web interface demonstrates how insecure input handling can create opportunities for privilege escalation and system control. The exploitation of this flaw aligns with ATT&CK technique T1210, which involves exploiting vulnerabilities in remote services to gain access to systems. The public availability of exploit code significantly increases the threat surface, as it removes the requirement for advanced technical skills from potential attackers.
The operational impact of this vulnerability extends beyond simple unauthorized access to encompass complete system compromise and potential network infiltration. Successful exploitation could allow attackers to execute arbitrary commands on the router, potentially leading to persistent backdoor access or enabling further attacks against connected networks. The affected device's role as a gateway means that compromise of the router could provide attackers with privileged network access and the ability to monitor or manipulate traffic passing through the device.
Mitigation strategies should include immediate firmware updates from Totolink to address the buffer overflow vulnerability, along with network segmentation to limit potential attack vectors. Network administrators should implement monitoring for unusual login patterns and unauthorized configuration changes. The use of intrusion detection systems can help identify exploitation attempts targeting this specific vulnerability. Additionally, disabling unnecessary remote management features and implementing strong authentication measures can reduce the likelihood of successful exploitation. Organizations should also consider applying network access controls to restrict access to router management interfaces from untrusted networks while maintaining proper logging and auditing capabilities for security monitoring purposes.