Description
A vulnerability was found in Totolink N300RH 6..1c.1353_B20190305. The affected element is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used.
Published: 2026-03-08
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Command Execution
Action: Immediate Patch
AI Analysis

Impact

An OS command injection vulnerability exists in the setWiFiWpsConfig function of the cstecgi.cgi CGI handler on Totolink N300RH routers. By sending a specially crafted HTTP request to the /cgi-bin/cstecgi.cgi endpoint, an attacker can inject arbitrary operating system commands, enabling remote execution of commands on the device. The vulnerability is remote and the description does not specify any authentication requirement, implying that the flaw may be exploitable without credentials.

Affected Systems

The affected devices are Totolink N300RH routers running firmware version 6.1c.1353_B20190305. No other firmware versions are explicitly identified as vulnerable in the available information.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of <1% suggests a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can remotely trigger the flaw via the public‑facing /cgi-bin/cstecgi.cgi endpoint, and the lack of an authentication requirement points to a potential unauthenticated attack scenario.

Generated by OpenCVE AI on April 21, 2026 at 23:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the router to the latest firmware that incorporates the fixed setWiFiWpsConfig function.
  • Disable the WPS feature in the router’s administration interface to remove the vulnerable CGI endpoint.
  • Apply firewall rules or network segmentation to block external access to the /cgi-bin/cstecgi.cgi path and expose the router only on a trusted internal network.
  • Enable logging of CGI requests and monitor for anomalous command usage to detect potential exploitation attempts.

Generated by OpenCVE AI on April 21, 2026 at 23:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 11 Mar 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 10 Mar 2026 19:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:h:totolink:n300rh:4.0:*:*:*:*:*:*:*
cpe:2.3:o:totolink:n300rh_firmware:6.1c.1353_b20190305:*:*:*:*:*:*:*

Mon, 09 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Totolink n300rh
Vendors & Products Totolink n300rh

Sun, 08 Mar 2026 01:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in Totolink N300RH 6..1c.1353_B20190305. The affected element is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used.
Title Totolink N300RH CGI cstecgi.cgi setWiFiWpsConfig os command injection
First Time appeared Totolink
Totolink n300rh Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:totolink:n300rh_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink n300rh Firmware
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Totolink N300rh N300rh Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-11T16:27:23.403Z

Reserved: 2026-03-07T08:40:39.166Z

Link: CVE-2026-3696

cve-icon Vulnrichment

Updated: 2026-03-11T16:26:37.403Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-08T01:15:49.943

Modified: 2026-03-10T18:57:26.967

Link: CVE-2026-3696

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T23:45:02Z

Weaknesses