CVE-2026-7748

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A weakness has been identified in Totolink N300RH 3.2.4-B20220812. Affected by this issue is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Executing a manipulation of the argument FileName can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119CWE-120

Affected software

No affected versions have been published.

Timeline

Published
May 4, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-774808.8Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-774818.8Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-774828.8Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.CVE-2026-774838.8Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-774848.8Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-774857.0Use after free in SQL Server allows an authorized attacker to elevate privileges locally.CVE-2026-774868.8Integer overflow or wraparound in SQL Server allows an unauthorized attacker to execute code over a network.CVE-2026-774878.8Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-774885.5Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally.CVE-2026-774897.8Null pointer dereference in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-77498.8A security vulnerability has been detected in Totolink N300RH 3.2.4-B20220812. This affects the function setWanConfig of the file /cgi-bin/cCVE-2026-774906.1Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthoriz
CVE-2026-7748: High severity, CVSS 8.8 | Vulnix