CVE-2026-10187: Critical RCE in Totolink N300RH Routers
The National Vulnerability Database has disclosed CVE-2026-10187, a critical stack-based buffer overflow vulnerability affecting Totolink N300RH routers, specifically version 6.1c.1353_B20190305. This flaw resides within the setWiFiBasicConfig function of the wireless.so component, accessible via the device’s web management interface. Attackers can trigger the overflow remotely by manipulating the KeyStr argument.
Rated with a CVSSv3.1 score of 9.8 (CRITICAL), this vulnerability requires no authentication or user interaction to exploit (AV:N/AC:L/PR:N/UI:N). The National Vulnerability Database confirms that a public exploit is available, drastically increasing the immediate risk. This is a classic case of unpatched edge devices becoming easy targets, ripe for botnet recruitment or initial access points into broader networks.
For defenders, this is a clear and present danger. Attackers favor readily exploitable critical vulnerabilities in network infrastructure. An unauthenticated remote buffer overflow on a router means full device compromise – likely leading to arbitrary code execution. This allows an adversary to pivot, intercept traffic, or establish persistence within the network perimeter. The absence of specified affected products beyond the N300RH model suggests this could be part of a broader, unpatched firmware issue across Totolink’s product line.
What This Means For You
- If your organization or employees use Totolink N300RH routers, especially the 6.1c.1353_B20190305 firmware, you need to isolate or replace these devices immediately. Given the public exploit and critical severity, these are low-hanging fruit for attackers. Audit your network edge for any Totolink devices and prioritize patching or decommissioning.
Related ATT&CK Techniques
🛡️ Detection Rules
2 rules · 6 SIEM formats2 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-10187 - Totolink N300RH setWiFiBasicConfig RCE
title: CVE-2026-10187 - Totolink N300RH setWiFiBasicConfig RCE
id: scw-2026-05-31-ai-1
status: experimental
level: critical
description: |
Detects attempts to exploit CVE-2026-10187 by targeting the setWiFiBasicConfig function within wireless.so. The presence of 'KeyStr=' in the query string is a strong indicator of the buffer overflow exploit targeting this specific vulnerability in Totolink N300RH routers.
author: SCW Feed Engine (AI-generated)
date: 2026-05-31
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-10187/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/wireless.so'
cs-uri-query|contains:
- 'setWiFiBasicConfig'
cs-uri-query|contains:
- 'KeyStr='
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-10187 | Buffer Overflow | Totolink N300RH version 6.1c.1353_B20190305 |
| CVE-2026-10187 | Buffer Overflow | Vulnerable function: setWiFiBasicConfig in wireless.so |
| CVE-2026-10187 | Buffer Overflow | Vulnerable component: Web Management Interface |
| CVE-2026-10187 | Buffer Overflow | Vulnerable argument: KeyStr leading to stack-based buffer overflow |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 31, 2026 at 18:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-48209: OTRS XSS Exposes Agent Sessions to Attackers
CVE-2026-48209 — An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected cross-site scripting (XSS)...
CVE-2026-48208 — Denial of Service
CVE-2026-48208 — An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG...
CVE-2026-48189 — OTRS Customer Backend Module Vulnerability
CVE-2026-48189 — An improper Input Validation vulnerability in OTRS Customer Backend module allows to access customer information which are restricted to other groups. Please note...