This vulnerability affects the Totolink LR350 router firmware 9.3.5u.6369_B20220309. The issue lies in the setWiFiGuestCfg function of the /cgi-bin/cstecgi.cgi CGI script, where improper handling of the ssid argument leads to a buffer overflow condition. This flaw allows a remote attacker to potentially execute arbitrary code or cause a denial of service. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Exploit code has been publicly released, but no known exploits in the wild have been reported yet. No patch or official remediation guidance is currently available.

Successful exploitation of this buffer overflow vulnerability could allow a remote attacker to execute arbitrary code on the affected device or cause it to crash, leading to denial of service. Given the high CVSS score and public availability of exploit code, the risk of exploitation is significant. However, there are no confirmed reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, such as restricting remote management access or isolating the device from untrusted networks. Monitor vendor communications for updates on patches or official mitigations.