PT-2026-32259 · Totolink · N300Rh

Xuanyu · Published 2026-04-13 · Updated 2026-04-29 · CVE-2026-6158

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Totolink N300RH version 6.1c.1353 B20190305

Description A flaw in the setUpgradeUboot() function within the upgrade.so file allows for remote OS command injection. This occurs due to improper manipulation of the FileName argument, which can be exploited to execute arbitrary operating system commands on the device.

Recommendations Update Totolink N300RH version 6.1c.1353 B20190305 to a patched version. Isolate affected devices from the network to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-6158

Affected Products

N300Rh

References · 7

• 🔥 https://github.com/xyh4ck/iot_poc/tree/main/TOTOLINK/N300RHv4/02_setUpgradeUboot_RCE · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6158 · Security Note
• https://twitter.com/DFIR_Lab/status/2049286877832769920 · Twitter Post
• https://vuldb.com/submit/796426 · Note
• https://vuldb.com/vuln/357038/cti · Note
• https://totolink.net · Note
• https://vuldb.com/vuln/357038 · Note