PT-2026-28701 · Totolink · Totolink Lr350

Wxhwxhwxh_Mie · CVE-2026-4976 · Publicado 2026-03-12 · Atualizado 2026-03-28

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Totolink LR350 version 9.3.5u.6369 B20220309

Description A buffer overflow issue exists in the setWiFiGuestCfg function of the /cgi-bin/cstecgi.cgi file. The issue is triggered by manipulating the ssid argument. The exploit for this issue has been made public and could be used to launch remote attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Enumeração de Fraquezas

CWE-119

CWE-120

Identificadores relacionados

BDU:2026-07611

CVE-2026-4976

Produtos afetados

Totolink Lr350

Referências · 12

• 🔥 https://lavender-bicycle-a5a.notion.site/TOTOLINK-LR350-setWiFiGuestCfg-32153a41781f8048a918c1c78e95064e?source=copy_link · Exploit
• https://vuldb.com/?ctiid.353863 · Nota
• https://twitter.com/TheHackerWire/status/2037645122532458746 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2037646693974372633 · Publicação no Twitter
• https://lavender-bicycle-a5a.notion.site/TOTOLINK-LR350-setWiFiGuestCfg-32153a41781f8048a918c1c78e95064e · Nota
• https://twitter.com/vuldb/status/2037508751876600205 · Publicação no Twitter
• https://vuldb.com/?id.353863 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-4976 · Nota de Segurança
• https://totolink.net · Nota
• https://vuldb.com/?submit.778274 · Nota
• https://bdu.fstec.ru/vul/2026-07611 · Nota de Segurança
• https://twitter.com/CVEnew/status/2037719397088031036 · Publicação no Twitter