PT-2026-36623 · Totolink · N300Rh

Xuanyu · Published 2026-05-02 · Updated 2026-05-02 · CVE-2026-7633

Mitre

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

A vulnerability was identified in Totolink N300RH 6.1c.1353 B20190305. This impacts the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument FileName leads to file inclusion. The attack may be performed from remote. The exploit is publicly available and might be used.

Exploit

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2026-7633

Affected Products

N300Rh

References · 6

• 🔥 https://github.com/xyh4ck/iot_poc/tree/main/TOTOLINK/N300RHv4/03_setUploadSetting_ECFNP · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7633 · Security Note
• https://vuldb.com/vuln/360579 · Note
• https://vuldb.com/submit/806597 · Note
• https://vuldb.com/vuln/360579/cti · Note
• https://totolink.net · Note