PT-2026-23896 · Totolink · Totolink N300Rt

Bozaihuang · CVE-2026-3696 · Published 2026-02-23 · Updated 2026-03-13

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Totolink N300RH versions 6.1.1353 B20190305

Description A flaw exists in the CGI Handler component of Totolink N300RH, specifically within the setWiFiWpsConfig function of the /cgi-bin/cstecgi.cgi file. This allows for operating system command injection through manipulation. The issue is remotely exploitable and details of the exploit have been publicly released.

Recommendations Apply updates to address the vulnerability in the CGI Handler component. As a temporary workaround, restrict access to the /cgi-bin/cstecgi.cgi file. Consider disabling the WPS functionality until a patch is available.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2026-04456

CVE-2026-3696

Affected Products

Totolink N300Rt

References · 14

• 🔥 https://github.com/JXBbozaihuang/vuln-research/issues/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3696 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3696 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04456 · Security Note
• https://twitter.com/CVEnew/status/2030747894014480831 · Twitter Post
• https://vuldb.com/?submit.765681 · Note
• https://totolink.net · Note
• https://vuldb.com/?ctiid.349642 · Note
• https://t.me/CVEtracker/46769 · Telegram Post
• https://twitter.com/cracbot/status/2032411401906798695 · Twitter Post
• https://twitter.com/cyberbivash/status/2030453837396357259 · Twitter Post
• https://twitter.com/cracbot/status/2032049064884518980 · Twitter Post
• https://vuldb.com/?id.349642 · Note
• https://t.me/cveNotify/154640 · Telegram Post