CVE-2026-3301

CRITICAL

Totolink N300RH 6.1c.1353_B20190305 - Command Injection

Title source: llm

Description

A security flaw has been discovered in Totolink N300RH 6.1c.1353_B20190305. Affected by this vulnerability is the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument webWlanIdx results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

References (5)

Scores

CVSS v3 9.8
EPSS 0.0403
EPSS Percentile 88.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-78 CWE-77
Status published

Affected Products (2)

totolink/n300rh_firmware
totolink/n300rh_firmware

Timeline

Published Feb 27, 2026
Tracked Since Feb 27, 2026