CVE-2026-7747: Totolink N300RH Parameter cstecgi.cgi loginauth buffer overflow
A security flaw has been discovered in Totolink N300RH 3.2.4-B20220812. Affected by this vulnerability is the function loginauth of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. Performing a manipulation of the argument Password results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Because the vulnerability in Totolink N300RH (3.2.4-B20220812) affecting /cgi-bin/cstecgi.cgi (Parameter Handler) loginauth enables remote buffer overflow via Password manipulation, restrict access to the device’s web/CGI interface (including /cgi-bin/cstecgi.cgi) so it is reachable only from trusted networks/IPs.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7747?
CVE-2026-7747 is classified as a high-severity vulnerability due to its potential for exploitation through buffer overflow.
How do I fix CVE-2026-7747?
To fix CVE-2026-7747, users should update their Totolink N300RH device to the latest firmware version provided by the manufacturer.
What devices are affected by CVE-2026-7747?
CVE-2026-7747 affects the Totolink N300RH model running firmware version 3.2.4-B20220812.
What kind of vulnerability is CVE-2026-7747?
CVE-2026-7747 is a buffer overflow vulnerability found in the loginauth function of the cstecgi.cgi file.
What can an attacker potentially do with CVE-2026-7747?
An attacker exploiting CVE-2026-7747 could execute arbitrary code on the affected Totolink N300RH device, leading to unauthorized access.