CVE-2026-7218

HIGH

Totolink N300RT libapmib.so formWsc is_cmd_string_valid buffer overflow

Title source: cna
STIX 2.1

Description

A vulnerability was detected in Totolink N300RT 3.4.0-B20250430. The impacted element is the function is_cmd_string_valid of the file /boafrm/formWsc of the component libapmib.so. Performing a manipulation of the argument localPin results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.

References (5)

Scores

CVSS v3 7.2
EPSS 0.0007
EPSS Percentile 21.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-119 CWE-120
Status published
Products (1)
Totolink/N300RT 3.4.0-B20250430
Published Apr 28, 2026
Tracked Since Apr 28, 2026