A buffer overflow exists in the setUpgradeFW function of the POST Request Handler found in the /cgi-bin/cstecgi.cgi file. Manipulating the FileName argument allows an attacker to overflow an internal buffer, potentially yielding remote code execution. The flaw is a memory corruption problem identified as CWE-119 and involves a stack-based buffer overflow, labeled CWE-120. The vulnerability is not limited to local traffic; the description explicitly states that the attack can be launched remotely and that public exploits are available.

The vulnerability affects Totolink N300RH routers running firmware version 3.2.4-B20220812. Any device deployed with this specific firmware build is directly exposed.

The CVSS score of 8.7 assesses the issue as high severity, and because the vulnerability is remotely exploitable with publicly available exploits, it poses a significant risk. The EPSS score is unavailable, and the vulnerability is not currently listed in the CISA KEV catalog, but the lack of mitigation information heightens the potential for exploitation. The attack vector is likely a crafted POST request to the setUpgradeFW endpoint from an external network.