CVE-2026-10187

Executive Summary

CVE-2026-10187 is a critical, remotely exploitable stack-based buffer overflow vulnerability in the Totolink N300RH wireless router, specifically in firmware version 6.1c.1353_B20190305. The flaw resides in the setWiFiBasicConfig function within the wireless.so module of the web management interface. By manipulating the KeyStr argument, an unauthenticated attacker can trigger a buffer overflow, leading to arbitrary code execution with root privileges. With a CVSS score of 9.8, public exploit code available, and no patch currently released, this vulnerability poses an immediate and severe risk to all affected devices. This report provides a comprehensive technical analysis, detection strategies, and mitigation guidance.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full device compromise, data exfiltration possible.
• Integrity Impact: High (I:H) – Attacker can modify firmware, configuration, or inject malicious code.
• Availability Impact: High (A:H) – Denial of service or complete device takeover.

Threat Level: Critical. The combination of remote exploitability, no authentication requirement, public exploit availability, and no patch makes this a top-priority threat for any organization using the Totolink N300RH.

Deep Dive & Mechanics

The vulnerability is a classic stack-based buffer overflow in the setWiFiBasicConfig function of the wireless.so module. This function is part of the web management interface's CGI handler, which processes HTTP POST requests to configure WiFi settings.

Root Cause: The KeyStr parameter, which likely represents a WiFi key or passphrase, is copied into a fixed-size stack buffer without proper bounds checking. When an attacker supplies a string longer than the allocated buffer (e.g., > 512 bytes), the excess data overwrites adjacent stack memory, including the return address and other critical data.

Exploitation Flow:

1. An attacker sends a crafted HTTP POST request to the vulnerable endpoint (e.g., /goform/setWiFiBasicConfig).
2. The KeyStr parameter contains a payload that overflows the stack buffer.
3. The overflow overwrites the saved return address on the stack.
4. When the function returns, execution jumps to an address controlled by the attacker.
5. The attacker's shellcode (often a reverse shell or bind shell) executes with root privileges, granting full control over the router.

Impact: Full device compromise. The attacker can:

• Modify router configuration (DNS, firewall, routing).
• Intercept or redirect network traffic.
• Use the device as a pivot point for further attacks.
• Install persistent malware (e.g., Mirai botnet).
• Disable the device (DoS).

Vulnerable vs. Patched Code

Since no patch is available, this section describes the vulnerable code pattern and the expected fix.

Vulnerable Code (Conceptual C):

void setWiFiBasicConfig(struct request *req) {
    char key_buf[512];  // Fixed-size stack buffer
    char *key_str = get_param(req, "KeyStr");
    
    // VULNERABLE: No bounds checking
    strcpy(key_buf, key_str);
    
    // ... process key_buf ...
}

Patched Code (Expected Fix):

void setWiFiBasicConfig(struct request *req) {
    char key_buf[512];  // Fixed-size stack buffer
    char *key_str = get_param(req, "KeyStr");
    
    // SAFE: Use strncpy with size limit
    strncpy(key_buf, key_str, sizeof(key_buf) - 1);
    key_buf[sizeof(key_buf) - 1] = '\0';
    
    // ... process key_buf ...
}

The fix involves replacing strcpy with strncpy (or a similar bounded function) to ensure that the input does not exceed the buffer size. Additionally, input validation and length checks should be implemented at the application layer.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Hardware: Totolink N300RH router with firmware 6.1c.1353_B20190305.
2. Network: Attacker machine (Kali Linux) and target router on the same subnet.
3. Tools: curl, python3, pwntools, metasploit (if module available).

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -v http://<router_ip>/goform/setWiFiBasicConfig
   

2. Craft the exploit payload: The payload must overflow the KeyStr buffer and overwrite the return address with a controlled value. A typical payload structure:
   • Padding (e.g., 512 bytes of 'A')
   • Overwritten return address (e.g., address of a jmp esp gadget)
   • Shellcode (e.g., reverse shell for MIPS architecture)
3. Send the exploit:

   import requests
   
   target = "http://192.168.1.1/goform/setWiFiBasicConfig"
   payload = b"A" * 512 + b"\x00\x01\x02\x03" + b"\x90" * 100 + shellcode
   
   data = {"KeyStr": payload}
   requests.post(target, data=data)
   

4. Receive shell: The attacker's listener (e.g., nc -lvnp 4444) receives a reverse shell.

Note: The exact offset and ROP gadgets depend on the specific firmware binary. Use gdb-multiarch or qemu to analyze the wireless.so module.

Blue Team (Defensive)

Detection & Response:

1. Monitor for anomalous HTTP requests: Look for POST requests to /goform/setWiFiBasicConfig with unusually long KeyStr parameters.
2. Network traffic analysis: Detect outbound connections from the router to unknown IPs on unusual ports (e.g., 4444, 31337).
3. Log analysis: Check router logs for crashes or unexpected reboots.
4. Honeypot: Deploy a decoy router to capture exploit attempts.

Mitigation:

• Immediate: Disable remote management and isolate the router on a separate VLAN.
• Long-term: Replace the device with a patched or alternative model.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /goform/setWiFiBasicConfig with KeyStr > 512 bytes.
  • Outbound connections from the router to suspicious IPs (e.g., 5.5.5.5:4444).
  • Unusual DNS queries or traffic patterns.
• Host IOCs:
  • Unexpected processes running on the router (e.g., /tmp/.x).
  • Modified firmware or configuration files.
  • Presence of shellcode in memory (detectable via strings on /dev/mem).
• File IOCs:
  • New files in /tmp/ or /var/ with suspicious names (e.g., mirai, bot).
  • Changes to /etc/init.d/ or /etc/crontab.

Detection Engineering

YARA Rule

rule CVE_2026_10187_Totolink_Overflow {
    meta:
        description = "Detects exploit attempts for CVE-2026-10187 in HTTP traffic"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-10187"
    strings:
        $http_post = "POST /goform/setWiFiBasicConfig"
        $key_str = "KeyStr="
        $long_payload = /KeyStr=[A-Za-z0-9%]{512,}/
    condition:
        $http_post and $key_str and $long_payload
}

Sigma Rule

title: CVE-2026-10187 Totolink N300RH Buffer Overflow Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP POST requests with excessively long KeyStr parameter targeting Totolink N300RH routers.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/goform/setWiFiBasicConfig'
        cs-uri-query|contains: 'KeyStr='
    condition: selection and len(cs-uri-query) > 600
falsepositives:
    - Legitimate long WiFi keys (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-10187 Totolink N300RH Buffer Overflow Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/goform/setWiFiBasicConfig"; http_uri;
    content:"KeyStr="; http_client_body;
    pcre:"/KeyStr=[A-Za-z0-9%]{512,}/";
    sid:10000001;
    rev:1;
    priority:1;
    reference:cve,2026-10187;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Remote Management: Turn off WAN-side access to the web interface.
2. Network Segmentation: Place the router on an isolated VLAN with strict firewall rules.
3. Monitor Traffic: Deploy the above detection rules to identify exploit attempts.
4. Firmware Update: Check Totolink's website for any future patches. If none, consider replacing the device.

Long-Term Actions:

1. Replace Device: Migrate to a supported router model with active security updates.
2. Vendor Notification: Report the vulnerability to Totolink if not already done.
3. Incident Response: If compromise is suspected, factory reset the device and update credentials.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.