{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/products/n300rh-3.2.4-b20220812/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-7749"}],"_cs_exploited":false,"_cs_products":["N300RH 3.2.4-B20220812"],"_cs_severities":["high"],"_cs_tags":["buffer-overflow","router","cve-2026-7749"],"_cs_type":"advisory","_cs_vendors":["Totolink"],"content_html":"\u003cp\u003eA buffer overflow vulnerability has been identified in Totolink N300RH router version 3.2.4-B20220812. The vulnerability resides in the \u003ccode\u003esetWanConfig\u003c/code\u003e function within the \u003ccode\u003e/cgi-bin/cstecgi.cgi\u003c/code\u003e file, which handles POST requests. An attacker can exploit this vulnerability by manipulating the \u003ccode\u003epriDns\u003c/code\u003e argument in a crafted POST request. The vulnerability allows for remote exploitation, meaning an attacker does not need local access to the device. Public exploits for this vulnerability are already available, increasing the risk of exploitation. This vulnerability was published on 2026-05-04.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a vulnerable Totolink N300RH router running firmware version 3.2.4-B20220812.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious POST request targeting the \u003ccode\u003e/cgi-bin/cstecgi.cgi\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eWithin the POST request, the attacker includes the \u003ccode\u003epriDns\u003c/code\u003e argument with a value exceeding the buffer size.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003esetWanConfig\u003c/code\u003e function processes the \u003ccode\u003epriDns\u003c/code\u003e argument without proper bounds checking.\u003c/li\u003e\n\u003cli\u003eThe oversized \u003ccode\u003epriDns\u003c/code\u003e value overwrites adjacent memory on the stack, potentially including control flow data.\u003c/li\u003e\n\u003cli\u003eThe attacker gains control of the program execution flow by overwriting the return address.\u003c/li\u003e\n\u003cli\u003eThe attacker executes arbitrary code on the router, potentially gaining a shell.\u003c/li\u003e\n\u003cli\u003eThe attacker could then use the compromised router to perform lateral movement, exfiltrate data, or establish a persistent backdoor.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this buffer overflow vulnerability can lead to complete compromise of the Totolink N300RH router. An attacker could gain unauthorized access to the device\u0026rsquo;s configuration, intercept network traffic, or use the router as a pivot point to attack other devices on the network. Given that public exploits are available, a wide range of attackers could potentially exploit this vulnerability. The CVSS v3.1 base score is 8.8 (HIGH).\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor web server logs for POST requests to \u003ccode\u003e/cgi-bin/cstecgi.cgi\u003c/code\u003e with abnormally long \u003ccode\u003epriDns\u003c/code\u003e values to detect potential exploitation attempts using the provided Sigma rule.\u003c/li\u003e\n\u003cli\u003eImplement network intrusion detection system (NIDS) rules to detect and block malicious POST requests targeting \u003ccode\u003e/cgi-bin/cstecgi.cgi\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eContact Totolink for a security patch or firmware update to address CVE-2026-7749.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-04T10:16:01Z","date_published":"2026-05-04T10:16:01Z","id":"/briefs/2026-05-totolink-n300rh-buffer-overflow/","summary":"A buffer overflow vulnerability exists in Totolink N300RH version 3.2.4-B20220812, specifically affecting the setWanConfig function within the /cgi-bin/cstecgi.cgi file, allowing a remote attacker to exploit it by manipulating the priDns argument in a POST request.","title":"Totolink N300RH Buffer Overflow Vulnerability in setWanConfig","url":"https://feed.craftedsignal.io/briefs/2026-05-totolink-n300rh-buffer-overflow/"},{"_cs_actors":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-7750"}],"_cs_exploited":false,"_cs_products":["N300RH 3.2.4-B20220812"],"_cs_severities":["critical"],"_cs_tags":["buffer-overflow","router","cve","webserver"],"_cs_type":"advisory","_cs_vendors":["Totolink"],"content_html":"\u003cp\u003eA buffer overflow vulnerability, identified as CVE-2026-7750, affects Totolink N300RH router version 3.2.4-B20220812. The vulnerability resides in the \u003ccode\u003esetMacFilterRules\u003c/code\u003e function within the \u003ccode\u003e/cgi-bin/cstecgi.cgi\u003c/code\u003e file, which handles POST requests. Attackers can exploit this flaw by sending a specially crafted POST request with an overly long \u003ccode\u003emac_address\u003c/code\u003e parameter, triggering a buffer overflow. Successful exploitation allows for arbitrary code execution on the device. The vulnerability is remotely exploitable, and a public exploit is available, increasing the risk of widespread attacks. Defenders should prioritize patching or mitigating this vulnerability to prevent potential compromise of affected devices.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a vulnerable Totolink N300RH router running firmware version 3.2.4-B20220812.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious POST request targeting the \u003ccode\u003e/cgi-bin/cstecgi.cgi\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eWithin the POST request, the attacker includes the \u003ccode\u003emac_address\u003c/code\u003e parameter, injecting a string longer than the buffer allocated for it.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003esetMacFilterRules\u003c/code\u003e function processes the POST request without proper bounds checking on the \u003ccode\u003emac_address\u003c/code\u003e argument.\u003c/li\u003e\n\u003cli\u003eThe overly long \u003ccode\u003emac_address\u003c/code\u003e value overflows the buffer, overwriting adjacent memory regions.\u003c/li\u003e\n\u003cli\u003eThe attacker carefully crafts the overflow to overwrite the return address, redirecting execution flow to attacker-controlled code.\u003c/li\u003e\n\u003cli\u003eThe injected code executes with the privileges of the web server, allowing the attacker to execute arbitrary commands.\u003c/li\u003e\n\u003cli\u003eThe attacker gains complete control over the router, potentially using it for further malicious activities such as network pivoting, data exfiltration, or denial-of-service attacks.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-7750 allows a remote attacker to execute arbitrary code on the vulnerable Totolink N300RH device. This could lead to a complete compromise of the router, allowing the attacker to control network traffic, steal sensitive information, or use the router as a bot in a larger attack. Given the public availability of the exploit, a large number of unpatched devices could be vulnerable to automated attacks, potentially impacting thousands of users.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply available patches or firmware updates provided by Totolink to address CVE-2026-7750.\u003c/li\u003e\n\u003cli\u003eImplement network intrusion detection system (IDS) rules to detect and block suspicious POST requests targeting the \u003ccode\u003e/cgi-bin/cstecgi.cgi\u003c/code\u003e endpoint with excessively long \u003ccode\u003emac_address\u003c/code\u003e parameters.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rules in this brief to your SIEM to detect exploitation attempts.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for unusual POST requests to \u003ccode\u003e/cgi-bin/cstecgi.cgi\u003c/code\u003e, focusing on requests with large \u003ccode\u003emac_address\u003c/code\u003e values.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-04T10:16:01Z","date_published":"2026-05-04T10:16:01Z","id":"/briefs/2026-05-totolink-buffer-overflow/","summary":"A buffer overflow vulnerability exists in Totolink N300RH 3.2.4-B20220812 allowing remote attackers to execute arbitrary code by manipulating the mac_address argument in the setMacFilterRules function of the /cgi-bin/cstecgi.cgi POST request handler.","title":"Totolink N300RH Buffer Overflow Vulnerability (CVE-2026-7750)","url":"https://feed.craftedsignal.io/briefs/2026-05-totolink-buffer-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed — N300RH 3.2.4-B20220812","version":"https://jsonfeed.org/version/1.1"}