CVE-2023-48860

9.8 criticalEPSS 1.4%

Critical (9.8) in totolink n300rt firmware. EPSS 1.4% chance of exploitation in the next 30 days.

TOTOLINK N300RT version 3.2.4-B20180730.0906 has a post-authentication RCE due to incorrect access control, allows attackers can bypass front-end security restrictions and execute arbitrary code.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
Published: 2023-12-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

totolink:n300rt_firmware

References

https://github.com/xieqiang11/security_research/blob/main/TOTOLINK-N300RT-RCE.md
https://github.com/xieqiang11/security_research/blob/main/TOTOLINK-N300RT-RCE.md

Check your stack JSON