CVE-2026-7218

HIGH EPSS 36.7%

Published Apr 28, 20262mo ago · Modified Jun 17, 20262w ago

7.3 CVSS 4.0

High

Published Apr 28, 2026 2mo ago

Last Modified Jun 17, 2026 2w ago

Description

A vulnerability was detected in Totolink N300RT 3.4.0-B20250430. The impacted element is the function is_cmd_string_valid of the file /boafrm/formWsc of the component libapmib.so. Performing a manipulation of the argument localPin results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.

CVSS Details

Base Score

7.3

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Network

Attack Complexity Low

Privileges Required High

User Interaction None

Scope X

Threat Intelligence

EPSS Exploit Probability

36.7% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 2

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Memory Safety

CWE-120

References 5

github.com https://github.com/xiaohaiyang-ai/TOTOLINK-N300RT-Buffer-Overflow
vuldb.com https://vuldb.com/submit/802127
vuldb.com https://vuldb.com/vuln/359818
vuldb.com https://vuldb.com/vuln/359818/cti
totolink.net https://www.totolink.net/

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.