CVE-2026-3301

Totolink N300RH Web Management cstecgi.cgi setWebWlanIdx os command injection

State: Published
Severity: 9.3 Critical
Published: Feb 27, 2026
Updated: Feb 27, 2026
Reserved: Feb 26, 2026

Description

A security flaw has been discovered in Totolink N300RH 6.1c.1353_B20190305. Affected by this vulnerability is the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument webWlanIdx results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P	VulDB
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
3.0	9.8 Critical	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
2.0	10.0 High	AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-78 OS Command Injection
CWE-77 Command Injection

Affected Products

Product	Versions
N300RHTotolink	6.1c.1353_B20190305Affected

References

VDB-348052 | Totolink N300RH Web Management cstecgi.cgi setWebWlanIdx os command injectionvdb-entrytechnical-description
VDB-348052 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #761297 | TOTOLINK N300RH_V4 V6.1c.1353_B20190305 Command Injectionthird-party-advisory
https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/N300RHv4/01_setWebWlanIdx_RCE/README.mdexploit
https://www.totolink.net/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.