CVE-2023-7219 is a buffer overflow in the loginAuth function of the Totolink N350RT, firmware 9.3.5u.6139_B20201216. It scores 7.2 (High). The vendor did not respond to the reporter and the record names no fixed firmware, so keep the web admin interface off the internet and look for new firmware.
What's affected
Affected: Totolink N350RT on firmware 9.3.5u.6139_B20201216. The vulnerable code is the loginAuth function of /cgi-bin/cstecgi.cgi, and the argument is http_host.
Fixed: none is named in the record. The description says the vendor was contacted early about the disclosure and did not respond in any way. I found no vendor advisory, so check Totolink's download page for newer firmware before concluding that nothing exists.
The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vector requires a high privilege login (PR:H), which in practice means an administrator session. The weakness is CWE-121. The record says the exploit has been disclosed to the public and may be used. The KEV flag is false and no source I read says it is exploited in the wild. The description gives the firmware as 9.3.5u.6139_B202012 and the CPE data reads 9.3.5u.6139_B20201216. Confirm the exact build date on your device. This is a sibling of CVE-2023-7218, which covers the password argument in the same function.
Severity note: the description calls it critical (the VulDB label), while NVD scores it 7.2, High, because the vector requires high privileges. The title follows the score.
How to check if you're exposed
Sign in to the router's web interface and read the firmware version on the status or system page. If it matches 9.3.5u.6139_B20201216 on a N350RT, you are on the version named in the record.
Next, check exposure. From a device outside your network, see whether the router's public address answers on its admin port. A router with remote management enabled is reachable by anyone, and this class of bug is attacked through the same web server that serves the login page.
What to do now
- Look on the Totolink support site for firmware newer than the version you run, and apply it if one exists.
- Turn off remote management so the admin interface is reachable only from your local network.
- Keep untrusted devices, including guest Wi-Fi, off the segment that can reach the admin page.
- Change the admin password to a long unique one, and do not reuse it elsewhere.
- If no fix appears, plan to replace the router. An unpatched, unsupported edge device is a standing risk.
Why it matters
A buffer overflow happens when code copies input into a fixed size memory area without checking the length. On this class of router, the web server handles requests as a privileged process, so memory corruption in a login or settings handler can mean control of the device. The out-of-bounds write and stack overflow weaknesses here are among the most common in embedded firmware, because the code is written in C and input handling is often thin.
Control of a router is control of the traffic that passes through it. That includes DNS settings, port forwards and anything sent without end to end encryption. The practical defenses without a patch are to shrink exposure and to replace devices the vendor no longer supports.
Quick check
Is there a patch for CVE-2023-7219?
The record names no fixed firmware and the vendor did not respond to the reporter. Check Totolink's download page and treat the firmware in the record as vulnerable.
Can I fix it by changing my password?
No. A password does not fix a memory bug in the web server. Reducing who can reach the admin interface is the control that helps.
Sources
Last reviewed: 19 October 2026.
