CVE-2026-6158 | Totolink N300RH 6.1c.1353_B20190305 upgrade.so setUpgradeUboot FileName os command injection

A vulnerability identified as critical has been detected in Totolink N300RH 6.1c.1353_B20190305. Affected is the function setUpgradeUboot of the file upgrade.so. This manipulation of the argument FileName causes os command injection.

This vulnerability is tracked as CVE-2026-6158. The attack is possible to be carried out remotely. Moreover, an exploit is present.