CVE-2026-7748: Totolink N300RH POST Request cstecgi.cgi setUpgradeFW buffer overflow
A weakness has been identified in Totolink N300RH 3.2.4-B20220812. Affected by this issue is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Executing a manipulation of the argument FileName can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7748?
CVE-2026-7748 is classified as a high severity vulnerability due to the potential for buffer overflow exploitation.
How do I fix CVE-2026-7748?
To fix CVE-2026-7748, update the Totolink N300RH firmware to a version later than 3.2.4-B20220812.
What affected software is vulnerable to CVE-2026-7748?
The affected software is Totolink N300RH with firmware version 3.2.4-B20220812.
What type of vulnerability is CVE-2026-7748?
CVE-2026-7748 is a buffer overflow vulnerability in the setUpgradeFW function of the Totolink N300RH.
What can attackers do with CVE-2026-7748?
Attackers can exploit CVE-2026-7748 to execute arbitrary code on the Totolink N300RH device.