This vulnerability affects the Totolink N300RH router running firmware version 3.2.4-B20220812. It arises from a buffer overflow condition in the setMacFilterRules function of the /cgi-bin/cstecgi.cgi POST request handler. Specifically, the vulnerability is triggered by manipulating the mac_address parameter, which leads to memory corruption. The vulnerability can be exploited remotely without user interaction or privileges, as indicated by the CVSS vector. The CVSS 4.0 base score is 8.7, reflecting high severity due to network attack vector, low attack complexity, no privileges required, and high impact on confidentiality, integrity, and availability. Although an exploit is publicly available, there is no vendor-provided patch or official remediation at this time.

Successful exploitation of this buffer overflow vulnerability can lead to remote code execution or denial of service on the affected device. The attacker can potentially compromise the router's confidentiality, integrity, and availability. Given the remote attack vector and lack of required privileges, the vulnerability poses a significant risk to affected devices. However, there is no evidence of active exploitation in the wild as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a vendor fix is available, users should consider limiting network exposure of the affected device, such as restricting access to the management interface from untrusted networks. Monitor official Totolink channels for updates or patches addressing this vulnerability.