Medium severity · published May 2, 2026
CVE-2026-7633
Totolink N300RH cstecgi.cgi setUploadSetting file inclusion
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was identified in Totolink N300RH 6.1c.1353_B20190305. This impacts the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument FileName leads to file inclusion. The attack may be performed from remote. The exploit is publicly available and might be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
N3
N300RH · Totolink
6.1c.1353_B20190305 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-7633
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-7633
github.com
https://github.com/xyh4ck/iot_poc/tree/main/TOTOLINK/N300RHv4/03_setUploadSetting_ECFNP
vuldb.com
https://vuldb.com/submit/806597
vuldb.com
https://vuldb.com/vuln/360579
vuldb.com
https://vuldb.com/vuln/360579/cti
www.totolink.net
https://www.totolink.net/
More from N300RH
9.8
CVE-2026-10187
Totolink N300RH Web Management wireless.so setWiFiBasicConfig stack-based overflow
9.8
CVE-2026-9543
Totolink N300RH Web Management cstecgi.cgi setPasswordCfg os command injection
9.8
CVE-2026-7747
Totolink N300RH Parameter cstecgi.cgi loginauth buffer overflow
9.8
CVE-2026-3696
Totolink N300RH CGI cstecgi.cgi setWiFiWpsConfig os command injection
9.8
CVE-2026-3301
Totolink N300RH Web Management cstecgi.cgi setWebWlanIdx os command injection