CVE-2026-7633

Totolink N300RH cstecgi.cgi setUploadSetting file inclusion

View on CVE.org
Published May 2, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was identified in Totolink N300RH 6.1c.1353_B20190305. This impacts the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument FileName leads to file inclusion. The attack may be performed from remote. The exploit is publicly available and might be used.

Analysis

AI-generated

Technical impact

A file inclusion vulnerability exists in the setUploadSetting function in /cgi-bin/cstecgi.cgi of Totolink N300RH firmware 6.1c.1353_B20190305. The unvalidated FileName argument allows an attacker to include arbitrary local or remote files, potentially executing code or disclosing sensitive content. The flaw is classified as CWE‑73. It can be exploited from outside the device without prior authentication.

Affected Systems

The vulnerable product is Totolink N300RH. Firmware version 6.1c.1353_B20190305 carries the flaw. Earlier firmware builds that use the same cgi script may also be impacted. The issue is specific to the Totolink N300RH model and its management interface.

Risk and Exploitability

The CVSS score is 6.9, indicating medium severity. EPSS is not available, but publicly available exploit code in the wild raises the likelihood of exploitation. KEV does not list this vulnerability. The flaw can be triggered remotely via HTTP requests targeting /cgi-bin/cstecgi.cgi, potentially leading to code execution or information disclosure.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the device to the latest Totolink N300RH firmware that addresses the setUploadSetting vulnerability.
  • If an upgrade is not immediately possible, restrict external access to /cgi-bin/cstecgi.cgi using firewall rules or access control lists, allowing only trusted internal networks.
  • Disable or remove the setUploadSetting functionality or the cgi script entirely if it is not required for network operation.

Generated by OpenCVE AI on May 2, 2026 at 15:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Totolink n300rh
Vendors & Products Totolink n300rh
Type Values Removed Values Added
Description A vulnerability was identified in Totolink N300RH 6.1c.1353_B20190305. This impacts the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument FileName leads to file inclusion. The attack may be performed from remote. The exploit is publicly available and might be used.
Title Totolink N300RH cstecgi.cgi setUploadSetting file inclusion
First Time appeared Totolink
Totolink n300rh Firmware
Weaknesses CWE-73
CPEs cpe:2.3:o:totolink:n300rh_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink n300rh Firmware
References
Metrics cvssV2_0

{'score': 6.4, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-73

    External Control of File Name or Path

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
May 4, 2026, 3:31 PM
Reserved
May 1, 2026, 2:34 PM

View source JSON

Updated
May 4, 2026, 3:31 PM

JSON

Status
Deferred
Published
May 2, 2026, 3:16 PM
Modified
Oct 26, 2026, 8:10 PM

View source JSON

No data.

Updated
May 2, 2026, 3:30 PM

JSON