This vulnerability in Totolink N300RH 6.1c.1353_B20190305 arises from improper handling of the FileName argument in the setUploadSetting function within /cgi-bin/cstecgi.cgi. An attacker can remotely manipulate this argument to perform file inclusion, potentially accessing or executing unauthorized files on the device. The CVSS 4.0 base score is 6.9, reflecting network attack vector, no privileges or user interaction required, and limited impact on confidentiality and availability. No official fix or vendor advisory is available at this time.

Successful exploitation allows an unauthenticated remote attacker to include files on the affected device, which may lead to unauthorized information disclosure or limited disruption of service. The impact is rated medium severity based on the CVSS score of 6.9. There is no evidence of widespread exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the device's management interface from untrusted networks to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.