CVE-2024-42966: Totolink n350rt Firmware

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Incorrect access control in TOTOLINK N350RT V9.3.5u.6139_B20201216 allows attackers to obtain the apmib configuration file, which contains the username and the password, via a crafted request to /cgi-bin/ExportSettings.sh.

Affected products

• Totolink n350rt Firmware: version 9.3.5u.6139_b20201216 only

Published 2024-08-15. Last modified 2026-06-17.