PT-2026-23896 · Totolink · Totolink N300Rt

Bozaihuang · Publicado 2026-02-23 · Atualizado 2026-03-13 · CVE-2026-3696

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Totolink N300RH versions 6.1.1353 B20190305

Description A flaw exists in the CGI Handler component of Totolink N300RH, specifically within the setWiFiWpsConfig function of the /cgi-bin/cstecgi.cgi file. This allows for operating system command injection through manipulation. The issue is remotely exploitable and details of the exploit have been publicly released.

Recommendations Apply updates to address the vulnerability in the CGI Handler component. As a temporary workaround, restrict access to the /cgi-bin/cstecgi.cgi file. Consider disabling the WPS functionality until a patch is available.

Exploit

Correção

OS Command Injection

Command Injection

Enumeração de Fraquezas

CWE-78

CWE-77

Identificadores relacionados

BDU:2026-04456

CVE-2026-3696

Produtos afetados

Totolink N300Rt

Referências · 14

• 🔥 https://github.com/JXBbozaihuang/vuln-research/issues/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3696 · Nota de Segurança
• https://twitter.com/CVEnew/status/2030747894014480831 · Publicação no Twitter
• https://vuldb.com/?submit.765681 · Nota
• https://totolink.net · Nota
• https://vuldb.com/?ctiid.349642 · Nota
• https://t.me/CVEtracker/46769 · Publicação no Telegram
• https://twitter.com/cracbot/status/2032411401906798695 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2030453837396357259 · Publicação no Twitter
• https://twitter.com/cracbot/status/2032049064884518980 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-3696 · Aviso do Fabricante
• https://vuldb.com/?id.349642 · Nota
• https://bdu.fstec.ru/vul/2026-04456 · Nota de Segurança
• https://t.me/cveNotify/154640 · Publicação no Telegram