CVE-2026-7749: Totolink N300RH POST Request cstecgi.cgi setWanConfig buffer overflow
A security vulnerability has been detected in Totolink N300RH 3.2.4-B20220812. This affects the function setWanConfig of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument priDns leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7749?
CVE-2026-7749 is classified as a critical vulnerability due to the potential for remote code execution through buffer overflow.
How do I fix CVE-2026-7749?
To fix CVE-2026-7749, update the Totolink N300RH firmware to a version newer than 3.2.4-B20220812.
What component is affected by CVE-2026-7749?
CVE-2026-7749 affects the POST Request Handler in the setWanConfig function of the cstecgi.cgi file.
Is the Totolink N300RH affected by CVE-2026-7749?
Yes, the Totolink N300RH version 3.2.4-B20220812 is affected by CVE-2026-7749.
What action should I take if I cannot update my Totolink N300RH device for CVE-2026-7749?
If unable to update, consider disabling remote access or applying firewall rules to mitigate the risk of exploitation for CVE-2026-7749.