CVE-2026-7747

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in Totolink N300RH 3.2.4-B20220812. Affected by this vulnerability is the function loginauth of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. Performing a manipulation of the argument Password results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

No affected versions have been published.

Timeline

Published: May 4, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-774708.3Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow ac CVE-2026-774747.1destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior CVE-2026-77488.8A weakness has been identified in Totolink N300RH 3.2.4-B20220812. Affected by this issue is the function setUpgradeFW of the file /cgi-bin/CVE-2026-774808.8Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-774818.8Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-774828.8Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.CVE-2026-774838.8Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-774848.8Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-774857.0Use after free in SQL Server allows an authorized attacker to elevate privileges locally.CVE-2026-774868.8Integer overflow or wraparound in SQL Server allows an unauthorized attacker to execute code over a network.CVE-2026-774878.8Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-774885.5Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally.