Executive brief
The Totolink N300RH wireless router contains a security flaw in its web management interface. An attacker can exploit this vulnerability to take complete control of the device without needing a username or password. This could allow a remote actor to intercept network traffic, disrupt internet connectivity, or use the router as a foothold for further attacks on the local network.
Technical details
An OS command injection vulnerability exists in the Totolink N300RH V4 router within the 'setUpgradeUboot' handler of the 'upgrade.so' library. The vulnerability is located in the 'FileName' parameter, which is retrieved via 'websGetVar()' and passed to the 'mtd_write_bootloader()' function without sanitization. This parameter is subsequently concatenated into a shell command string and executed with root privileges via 'CsteSystem()'. A remote, unauthenticated attacker can exploit this by sending a specially crafted POST request to '/cgi-bin/cstecgi.cgi?topicurl=setUpgradeUboot', leading to full system compromise. Proof-of-concept exploits have been publicly disclosed.
Affected products
- Totolink N300RH 6.1c.1353_B20190305, 6.1c.1390_B20191101
Timeline
- 2026-04-13: disclosed: Initial vulnerability disclosure and CVE assignment.
- 2026-04-13: advisory: NVD published the vulnerability record.