This vulnerability in Totolink N300RH 3.2.4-B20220812 involves a buffer overflow triggered by manipulating the mac_address parameter in the setMacFilterRules function of the /cgi-bin/cstecgi.cgi POST request handler. The flaw allows remote attackers to potentially execute arbitrary code or cause denial of service by sending crafted requests. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official remediation or patch is currently documented.

Successful exploitation can lead to remote code execution or denial of service on the affected device, compromising confidentiality, integrity, and availability. The vulnerability is remotely exploitable without authentication or user interaction, increasing the risk. However, there are no confirmed reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device's management interface from untrusted networks and monitor for suspicious activity targeting the /cgi-bin/cstecgi.cgi endpoint. Avoid exposing the device management interface directly to the internet.