Vulnerability · Published May 2, 2026 · Assigned by VulDB
CVE-2026-7633Totolink N300RH cstecgi.cgi setUploadSetting file inclusion
Medium 6.5
In plain English
A medium-severity security flaw in N300RH from Totolink. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 73.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was identified in Totolink N300RH 6.1c.1353_B20190305. This impacts the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument FileName leads to file inclusion. The attack may be performed from remote. The exploit is publicly available and might be used.
Affected products (as reported)
Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-360579 | Totolink N300RH cstecgi.cgi setUploadSetting file inclusion vdb-entry, technical-description
- VDB-360579 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #806597 | TOTOLINK N300RH_V4 V6.1c.1353_B20190305 External Control of System or Configuration Setting third-party-advisory
- https://github.com/xyh4ck/iot_poc/tree/main/TOTOLINK/N300RHv4/03_setUploadSetting_ECFNP exploit
- https://www.totolink.net/ product