This vulnerability involves a buffer overflow in the loginauth function of the /cgi-bin/cstecgi.cgi file in Totolink N300RH firmware version 3.2.4-B20220812. By manipulating the Password parameter, an attacker can trigger a buffer overflow remotely without any privileges or user interaction. The vulnerability is publicly known and exploitable, with a CVSS 4.0 base score of 9.3, reflecting critical severity. No official fix or patch has been disclosed by Totolink as of the publication date.

Successful exploitation of this buffer overflow can lead to severe consequences such as remote code execution or denial of service on the affected device. Given the remote, unauthenticated nature of the vulnerability and the public availability of an exploit, affected devices are at significant risk of compromise. This could result in loss of device control, network disruption, or further lateral attacks within the network.

As no official patch or remediation guidance is currently available from the vendor, users should monitor Totolink's official channels for updates. Until a fix is released, consider restricting access to the device's management interface from untrusted networks to reduce exposure. Network-level protections such as firewall rules or intrusion prevention systems may help mitigate exploitation attempts. Avoid exposing the device's web management interface to the internet.