CVE-2026-3696: Totolink N300rh Firmware RCE Vulnerability

CVE-2026-3696 Overview

CVE-2026-3696 is an operating system command injection vulnerability affecting the Totolink N300RH router running firmware version 6.1c.1353_B20190305. The flaw resides in the setWiFiWpsConfig function within the /cgi-bin/cstecgi.cgi script, part of the device's CGI Handler component. An attacker can manipulate input parameters to inject arbitrary operating system commands. The attack vector is network-based and requires no authentication or user interaction. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed devices. The weakness maps to CWE-77 (Command Injection) and CWE-78 (OS Command Injection).

Critical Impact
Remote, unauthenticated attackers can inject operating system commands through the WPS configuration handler, compromising the integrity and availability of affected Totolink N300RH devices.

Affected Products

Totolink N300RH firmware 6.1c.1353_B20190305
Totolink N300RH hardware revision 4.0
Devices exposing the /cgi-bin/cstecgi.cgi CGI Handler interface

Discovery Timeline

2026-03-08 - CVE-2026-3696 published to the National Vulnerability Database (NVD)
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-3696

Vulnerability Analysis

The vulnerability exists in the setWiFiWpsConfig function implemented inside the /cgi-bin/cstecgi.cgi binary on the Totolink N300RH router. This CGI endpoint processes WPS (Wi-Fi Protected Setup) configuration requests submitted through the device's web management interface. The handler fails to properly sanitize user-supplied parameters before passing them to an underlying shell or command execution routine. Attackers can append shell metacharacters such as ;, |, or backticks to legitimate parameter values to execute additional commands. Because embedded device CGI handlers typically run as the root user, successful exploitation yields full control over the router. The vulnerability is exploitable over the network and does not require authentication, allowing attackers on the same network segment, or in some deployments the public internet, to compromise the device.

Root Cause

The root cause is insufficient input validation and missing sanitization of parameters consumed by setWiFiWpsConfig. The function constructs command strings using attacker-controlled data and dispatches them to a system shell without escaping or whitelisting allowed characters. This pattern aligns with CWE-78, where untrusted input is incorporated directly into OS command invocations.

Attack Vector

An attacker sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi invoking the setWiFiWpsConfig action with malicious payload data in one or more fields consumed by the vulnerable function. The injected shell commands execute on the router with the privileges of the CGI process. Technical details and proof-of-concept material are referenced in the public GitHub Issue Discussion and the corresponding VulDB entry #349642.

Detection Methods for CVE-2026-3696

Indicators of Compromise

Unexpected outbound connections from the router to unfamiliar IP addresses, particularly to known botnet command-and-control infrastructure
HTTP POST requests to /cgi-bin/cstecgi.cgi containing shell metacharacters such as ;, |, &, $(), or backticks within WPS-related parameters
New or unauthorized processes spawned from the router's httpd or CGI worker, including wget, tftp, nc, or shell instances
Unexpected modifications to firmware configuration, iptables rules, or DNS settings on the device

Detection Strategies

Inspect web server and reverse proxy logs in front of the router for POST requests targeting cstecgi.cgi with the setWiFiWpsConfig topic parameter
Deploy network intrusion detection signatures that match shell metacharacters in CGI parameter values destined for embedded device management ports
Correlate authentication-less administrative requests with anomalous post-request traffic such as outbound downloads or scanning behavior

Monitoring Recommendations

Enable verbose access logging on any reverse proxy, firewall, or IDS placed between users and Totolink management interfaces
Monitor for sudden firmware behavior changes, including modified DNS resolvers, new listening ports, or persistent cron entries on managed devices
Track router CPU and bandwidth usage for anomalies consistent with cryptominer or botnet activity following exploitation

How to Mitigate CVE-2026-3696

Immediate Actions Required

Restrict access to the router's web management interface to trusted internal hosts only, and never expose /cgi-bin/cstecgi.cgi to the public internet
Disable WPS functionality on the device until a vendor patch is available and verified
Place affected devices behind a network firewall that filters inbound HTTP and HTTPS requests to the router's management ports
Inventory all Totolink N300RH devices in the environment and confirm firmware versions against the affected build 6.1c.1353_B20190305

Patch Information

At the time of publication, no vendor-supplied patch was referenced in the CVE record. Administrators should monitor the Totolink Security Resource for firmware updates addressing the setWiFiWpsConfig command injection flaw. If the vendor does not release a fix, consider replacing affected hardware with supported equipment that receives active security maintenance.

Workarounds

Segment vulnerable routers onto isolated VLANs with strict access control lists limiting which hosts can reach the management interface
Disable remote management features and ensure the WAN-side administrative interface is not reachable from untrusted networks
Apply strong, unique administrative credentials and disable any default accounts to reduce post-exploitation lateral movement opportunities

bash

# Example: block external access to the router's management interface using an upstream firewall
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s <trusted_admin_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -s <trusted_admin_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP