CVE-2026-3696

HIGH

Totolink N300RH 6..1c.1353_B20190305 - Command Injection

Title source: llm

Description

A vulnerability was found in Totolink N300RH 6..1c.1353_B20190305. The affected element is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used.

References (5)

Scores

CVSS v3 7.3
EPSS 0.0054
EPSS Percentile 67.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Details

CWE
CWE-78 CWE-77
Status published
Products (1)
totolink/n300rh_firmware 6.1c.1353_b20190305
Published Mar 08, 2026
Tracked Since Mar 08, 2026