An unmanaged buffer overflow occurs in the setWiFiGuestCfg function of the cstecgi.cgi CGI script when the ssid argument is manipulated. The overflow can overwrite adjacent memory and potentially lead to arbitrary code execution, allowing an attacker to take full control of the affected device. The weakness corresponds to buffer overflow vulnerabilities.

The vulnerability is present in Totolink LR350 routers running firmware version 9.3.5u.6369_B20220309. No other firmware versions are listed as affected in the available data; therefore, the scope is limited to this specific build.

The CVSS scoring indicates a high severity level of 8.7, and an exploit is publicly available. The attack can be launched remotely, meaning anyone with network access to the router can attempt exploitation. While EPSS data is not provided and the issue is not listed in the CISA KEV catalog, the combination of a high score, remote reachability, and existing exploit code suggests a substantial risk that should be mitigated promptly.