The Totolink N300RH router firmware version 3.2.4-B20220812 contains a buffer overflow vulnerability in the setUpgradeFW function of the /cgi-bin/cstecgi.cgi POST request handler. Specifically, improper handling of the FileName argument allows an attacker to overflow a buffer remotely. This vulnerability is remotely exploitable without user interaction and has a high CVSS 4.0 score of 8.7, indicating significant impact potential. The vulnerability was publicly disclosed on 2026-05-04, and a public exploit is available. However, there is no vendor-provided patch or official remediation information at this time.

Successful exploitation of this vulnerability could allow a remote attacker to cause a buffer overflow on the affected device, potentially leading to denial of service or arbitrary code execution. The vulnerability is remotely exploitable without authentication or user interaction, increasing its risk. No confirmed exploitation in the wild has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the device's management interface from untrusted networks to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.