Description
A security vulnerability has been detected in TOTOLINK N600R up to 4.3.0cu.7866_B20220506. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi of the component HTTP Request Handler. Such manipulation of the argument wepkey leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Affected products
totolink: n600r firmware; totolink: n600r
References8
- github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/TOTOLINK/we… ExploitThird Party Advisory
- github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/TOTOLINK/we… Exploit
- github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/TOTOLINK/we… ExploitThird Party Advisory
- github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/TOTOLINK/we… Exploit
- vuldb.com/?ctiid.327381 Permissions RequiredVDB Entry
- vuldb.com/?id.327381 Third Party AdvisoryVDB Entry
- vuldb.com/?submit.666915 Third Party AdvisoryVDB Entry
- www.totolink.net/ Product
Metrics
- CVSS 3.1
-
8.8
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 4.0
-
7.4
HIGH
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 1% percentile: 65 · as of 9 November 2026
- CWE
- CWE-119CWE-120
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.