Description
A vulnerability was detected in Totolink N300RH 6.1c.1353_B20190305. Affected by this issue is the function setWiFiBasicConfig of the file wireless.so of the component Web Management Interface. Performing a manipulation of the argument KeyStr results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Published: 2026-05-31
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from a stack-based buffer overflow in the setWiFiBasicConfig function within the Web Management Interface of Totolink N300RH component wireless.so. Manipulating the KeyStr argument allows an attacker to corrupt the stack and potentially execute arbitrary code. The weakness is identified as CWE-119 and CWE-121, which typically enable remote code execution and unpredictable program behavior.

Affected Systems

The affected device is the Totolink N300RH router running firmware version 6.1c.1353_B20190305. No additional vendor/product versions are listed as affected.

Risk and Exploitability

With a CVSS score of 9.3, this vulnerability is classified as critical. Although the EPSS score is not available, the fact that the exploit is public and can be carried out remotely indicates a high likelihood of real-world exploitation. The vulnerability is not listed in the CISA KEV catalog, but its severity and remote nature make it a high‑priority threat.

Generated by OpenCVE AI on May 31, 2026 at 16:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware update from Totolink that addresses the stack overflow in wireless.so
  • If no patch is available, block or restrict external access to the router’s Web Management Interface using firewall rules or by disabling remote management features
  • Enable logging on the device and monitor for anomalous activity related to the Web Management Interface

Generated by OpenCVE AI on May 31, 2026 at 16:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 02 Jun 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 31 May 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Totolink n300rh
Vendors & Products Totolink n300rh

Sun, 31 May 2026 15:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in Totolink N300RH 6.1c.1353_B20190305. Affected by this issue is the function setWiFiBasicConfig of the file wireless.so of the component Web Management Interface. Performing a manipulation of the argument KeyStr results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Title Totolink N300RH Web Management wireless.so setWiFiBasicConfig stack-based overflow
First Time appeared Totolink
Totolink n300rh Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:totolink:n300rh_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink n300rh Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Totolink N300rh N300rh Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-06-02T14:51:15.521Z

Reserved: 2026-05-30T16:41:48.306Z

Link: CVE-2026-10187

cve-icon Vulnrichment

Updated: 2026-06-02T14:50:48.566Z

cve-icon NVD

Status : Deferred

Published: 2026-05-31T15:16:15.937

Modified: 2026-06-01T15:15:37.293

Link: CVE-2026-10187

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-31T16:30:06Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow