PT-2026-43248 · Totolink · N300Rh

A1Ester · Published 2026-04-28 · Updated 2026-05-26 · CVE-2026-9543

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Totolink N300RH version 6.1c.1353 B20190305

Description OS command injection is possible in the Web Management Interface via the setPasswordCfg() function located in the '/cgi-bin/cstecgi.cgi' endpoint. This occurs when the admpass argument is manipulated, allowing a remote attacker to execute arbitrary operating system commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2026-07424

CVE-2026-9543

Affected Products

N300Rh

References · 10

• 🔥 https://vuldb.com/submit/815068 · Exploit
• 🔥 https://github.com/A1ester/TOTOLINK-N300RH-Command-Injection · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-9543 · Security Note
• https://bdu.fstec.ru/vul/2026-07424 · Security Note
• https://github.com/A1ester/TOTOLINK-N300RH-Command-Injection/blob/main/TOTOLINK%20N300RH%20Command%20Injection%20Vulnerability.md · Note
• https://vuldb.com/vuln/365607 · Note
• https://totolink.net · Note
• https://twitter.com/vuldb/status/2059249750164344883 · Twitter Post
• https://t.me/CVEtracker/54976 · Telegram Post
• https://vuldb.com/vuln/365607/cti · Note