This vulnerability involves a buffer overflow in the is_cmd_string_valid function of the Totolink N300RT router firmware 3.4.0-B20250430. The flaw is triggered by manipulating the localPin argument remotely, leading to memory corruption. The affected code resides in the /boafrm/formWsc path within the libapmib.so component. The vulnerability has a CVSS 4.0 base score of 8.6, indicating high severity with network attack vector, low attack complexity, and no required user interaction. Exploit code is publicly available, increasing the risk of exploitation. No vendor advisory or patch information is currently provided.

Successful exploitation of this buffer overflow can lead to memory corruption on the affected device, potentially allowing an attacker with high privileges to execute arbitrary code remotely. Given the network attack vector and public exploit availability, affected devices are at significant risk of compromise if exposed to untrusted networks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected device's management interfaces and monitor for suspicious activity related to the localPin parameter. Avoid exposing the device to untrusted networks to reduce exploitation risk.