CVE-2026-7749

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in Totolink N300RH 3.2.4-B20220812. This affects the function setWanConfig of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument priDns leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119CWE-120

Affected software

No affected versions have been published.

Timeline

Published
May 4, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-774906.1Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorizCVE-2026-774915.5Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally.CVE-2026-774925.5Out-of-bounds read in Storage Port Driver allows an authorized attacker to disclose information locally.CVE-2026-774939.8Double free in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.CVE-2026-774947.5Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a CVE-2026-774958.8Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.CVE-2026-774968.8Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.CVE-2026-774987.5Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network.CVE-2026-774997.5Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a CVE-2026-77508.8A vulnerability was detected in Totolink N300RH 3.2.4-B20220812. This vulnerability affects the function setMacFilterRules of the file /cgi-CVE-2026-775007.8Release of invalid pointer or reference in Windows Device Association Service allows an authorized attacker to elevate privileges locally.CVE-2026-775017.5Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
CVE-2026-7749: High severity, CVSS 8.8 | Vulnix