An unauthenticated remote code execution vulnerability in Totolink N300RH routers poses a critical risk of full device compromise.

This vulnerability is an OS command injection (CWE-78) flaw within the /cgi-bin/cstecgi.cgi endpoint, where the PIN parameter is insufficiently sanitized before being passed to a system command. An unauthenticated attacker can exploit this via the web management interface to execute arbitrary shell commands with root-level privileges.

Successful exploitation grants an attacker full control over the affected router, which can be leveraged to intercept network traffic, pivot into internal networks, or participate in botnet activities. Given the CVSS score of 7.3, this represents a high-severity risk to confidentiality, integrity, and availability of the local network environment.

Immediate Action: Since no official vendor patch is currently available, immediately disable the remote web management interface and restrict access to the local network only. If possible, place the device behind a more secure gateway or disable the WPS functionality entirely.

Proactive Monitoring: Monitor device logs for unexpected inbound HTTP requests to /cgi-bin/cstecgi.cgi, particularly those containing shell metacharacters such as backticks, semicolons, or pipe operators.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block HTTP traffic containing malicious payloads targeting the WPS configuration parameters.

Public Exploit Available: Yes, a functional proof-of-concept is available via the researcher's published technical write-up on GitHub.

Due to the lack of an available firmware patch, organizations must prioritize network-level mitigations to prevent unauthorized access to the web management interface. Restricting interface access is the most effective way to neutralize this threat until the vendor provides a formal update.