Totolink n300rh Firmware vulnerabilities

7 CVEs affecting Totolink n300rh Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-3696, published 2026-03-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-3301, published 2026-02-27. Critical severity, CVSS 9.8. EPSS: 4.6% chance of exploitation in the next 30 days. A security flaw has been discovered in Totolink N300RH 6.1c.1353_B20190305. Affected by this vulnerability is the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi of the component Web…
CVE-2026-3696, published 2026-03-08. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. A vulnerability was found in Totolink N300RH 6..1c.1353_B20190305. The affected element is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a…
CVE-2025-4851, published 2025-05-18. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in TOTOLINK N300RH 6.1c.1390_B20191101. This vulnerability affects the function setUploadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation…
CVE-2025-4849, published 2025-05-18. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101. It has been rated as critical. Affected by this issue is the function CloudACMunualUpdateUserdata of the file /cgi-bin/cstecgi.cgi.…
CVE-2025-4850, published 2025-05-18. Medium severity, CVSS 6.3. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability classified as critical has been found in TOTOLINK N300RH 6.1c.1390_B20191101. This affects the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the…
CVE-2025-6400, published 2025-06-21. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101 and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formPortFw of the component HTTP…
CVE-2025-6401, published 2025-06-21. Low severity, CVSS 3.5. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101. It has been classified as problematic. This affects an unknown part of the file /boafrm/formFilter of the component HTTP POST Message…