Totolink N300Rh vulnerabilities

CVE-2026-6158 [MEDIUM] CWE-77 CVE-2026-6158: A flaw has been found in Totolink N300RH 6.1c.1353_B20190305. Affected is the function setUpgradeUbo A flaw has been found in Totolink N300RH 6.1c.1353_B20190305. Affected is the function setUpgradeUboot of the file upgrade.so. This manipulation of the argument FileName causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

CVE-2026-3696 [MEDIUM] CWE-77 CVE-2026-3696: A vulnerability was found in Totolink N300RH 6..1c.1353_B20190305. The affected element is the funct A vulnerability was found in Totolink N300RH 6..1c.1353_B20190305. The affected element is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used.

CVE-2026-3301 [HIGH] CWE-77 CVE-2026-3301: A security flaw has been discovered in Totolink N300RH 6.1c.1353_B20190305. Affected by this vulnera A security flaw has been discovered in Totolink N300RH 6.1c.1353_B20190305. Affected by this vulnerability is the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument webWlanIdx results in os command injection. The attack can be initiated remotely. The exploit has bee

CVE-2025-6400 [HIGH] CWE-119 CVE-2025-6400: A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101 and classified as critical. Affecte A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101 and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formPortFw of the component HTTP POST Message Handler. The manipulation of the argument service_type leads to buffer overflow. The attack may be launched remotely. The exploit has been disc

CVE-2025-6401 [MEDIUM] CWE-404 CVE-2025-6401: A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101. It has been classified as problema A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101. It has been classified as problematic. This affects an unknown part of the file /boafrm/formFilter of the component HTTP POST Message Handler. The manipulation of the argument url leads to denial of service. The exploit has been disclosed to the public and may be used.

CVE-2025-4849 [MEDIUM] CWE-74 CVE-2025-4849: A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101. It has been rated as critical. Aff A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101. It has been rated as critical. Affected by this issue is the function CloudACMunualUpdateUserdata of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument url leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may b

CVE-2025-4850 [MEDIUM] CWE-74 CVE-2025-4850: A vulnerability classified as critical has been found in TOTOLINK N300RH 6.1c.1390_B20191101. This a A vulnerability classified as critical has been found in TOTOLINK N300RH 6.1c.1390_B20191101. This affects the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument plugin_name leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-4851 [MEDIUM] CWE-74 CVE-2025-4851: A vulnerability classified as critical was found in TOTOLINK N300RH 6.1c.1390_B20191101. This vulner A vulnerability classified as critical was found in TOTOLINK N300RH 6.1c.1390_B20191101. This vulnerability affects the function setUploadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.