CVE-2026-4976

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Totolink LR350 9.3.5u.6369_B20220309. This vulnerability affects the function setWiFiGuestCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119CWE-120

Affected software

No affected versions have been published.

Timeline

Published
Mar 27, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-497605.5Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow. This vulnerability is associateCVE-2026-497625.1Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version stCVE-2026-497639.8Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.CVE-2026-497649.8Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions.CVE-2026-497659.8Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 versions.CVE-2026-497669.9Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions.CVE-2026-497679.8Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions.CVE-2026-497689.8Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.CVE-2026-497699.8Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.CVE-2026-49774.3The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Improper AccesCVE-2026-497709.8Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.CVE-2026-497717.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Photo Gallery by 10Web allows Bl
CVE-2026-4976: High severity, CVSS 8.8 | Vulnix