CVE-2026-7747
Published: 04 May 2026
Summary
CVE-2026-7747 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Notion (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-7747 is a buffer overflow vulnerability affecting the Totolink N300RH router running firmware version 3.2.4-B20220812. The flaw resides in the loginauth function of the /cgi-bin/cstecgi.cgi file within the Parameter Handler component, where manipulation of the Password argument triggers the overflow. Published on 2026-05-04, it is associated with CWE-119 and CWE-120 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical.
The vulnerability enables remote exploitation without authentication or user interaction. Attackers can send crafted requests over the network to the affected component, potentially leading to arbitrary code execution, data compromise, or denial of service, with high impacts on confidentiality, integrity, and availability.
Advisories referenced in VulDB entries (vuldb.com/vuln/360922 and related pages) document the issue and note that a public exploit has been released, available via a Notion site detailing the loginauth password manipulation. The vendor site at totolink.net should be consulted for any firmware patches or updates.
The public availability of the exploit heightens the risk of widespread attacks against unpatched Totolink N300RH devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26937
Vulnerability details
A security flaw has been discovered in Totolink N300RH 3.2.4-B20220812. Affected by this vulnerability is the function loginauth of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. Performing a manipulation of the argument Password results in buffer overflow. The attack…
more
can be initiated remotely. The exploit has been released to the public and may be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in unauthenticated public CGI endpoint (loginauth/Password) on network device web interface directly enables remote exploitation of public-facing application (T1190) leading to arbitrary code execution via Unix shell (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely flaw remediation through firmware updates to eliminate the buffer overflow in the loginauth function.
Mandates validation of the Password argument to block malformed inputs that trigger the buffer overflow.
Deploys memory protections such as non-executable stacks to mitigate successful exploitation of the buffer overflow for code execution.