This vulnerability affects Totolink N300RT firmware version 3.4.0-B20250430. The flaw is located in the is_cmd_string_valid function of the /boafrm/formWsc file within the libapmib.so component. By sending a specially crafted argument (localPin), an attacker can cause a buffer overflow remotely. The vulnerability has a CVSS 4.0 base score of 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The exploit code is publicly available, increasing the risk of exploitation. No vendor patch or official remediation has been documented at this time.

Successful exploitation of this vulnerability can lead to a buffer overflow condition, which may allow an attacker to execute arbitrary code or cause a denial of service on the affected device. Given the remote attack vector and public exploit availability, the risk of compromise is significant for devices running the specified firmware version.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device and monitor for unusual activity. Avoid using the vulnerable firmware version if possible.