A buffer overflow vulnerability exists in the setUpgradeFW function of the /cgi-bin/cstecgi.cgi POST request handler in Totolink N300RH version 3.2.4-B20220812. This flaw allows remote attackers with low privileges to manipulate the FileName argument, potentially leading to complete compromise of confidentiality, integrity, and availability. Public exploit code is available, and the vulnerability has a high severity rating with a CVSS score of 8.8.