EUVD-2026-107579
GHSA-q7j2-7qg9-m53h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device web interface
-
DeliverySend crafted cstecgi.cgi request
-
ExploitOverflow Comment buffer in lan.so
-
ExecutionHijack stack return address
-
ImpactExecute code as root
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the device's HTTP management interface (/cgi-bin/cstecgi.cgi) and the ability to invoke the setStaticDhcpConfig function with an attacker-controlled Comment parameter; per the PR:N/UI:N/AC:L vector no authentication, user interaction, or special configuration is needed against the affected firmware (EX200 5.2.3c.7200). The practical limiting factor is exposure of the management interface - primary risk is from the LAN side or from devices with the web UI reachable from the WAN/Internet; remote attacks across the internet depend on that interface being externally accessible, which is not the default for most extender deployments. |
| Impact | Multiple signals point to a genuinely high technical severity but a narrower real-world urgency than the 9.3 score suggests. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated stack-based buffer overflow (CWE-121) in the setStaticDhcpConfig handler of the cstecgi.cgi binary, and VulDB confirms public exploit code exists, so weaponization effort is low. However, the exploit maturity in the vector is only E:P (proof-of-concept), and the issue is NOT on the CISA KEV list, so there is no evidence of active in-the-wild exploitation. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified from this data. The vector's subsequent-system impacts (SC:H/SI:H/SA:H) and full vulnerable-system impacts (VC/VI/VA:H) are consistent with code execution on the device, but these appear to be VulDB's automated scoring and should be treated with caution - TOTOLINK CGI overflows typically yield code execution within the single device (no genuine scope change to other systems). Net: a real, easily-exploitable flaw with public PoC, but current risk is bounded by the limited (consumer/SOHO range-extender) deployment footprint and the absence of confirmed mass exploitation. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker who can reach the device's web management interface sends a crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking setStaticDhcpConfig with an overlong Comment argument, overflowing a stack buffer in lan.so and redirecting execution to attacker-controlled code running with the CGI process's (typically root) privileges. Public exploit code is already available (VulDB / GitHub PoC), lowering the bar to opportunistic attacks against internet-exposed or LAN-adjacent devices. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 21, 2026
Stack-based buffer overflow in the TOTOLINK EX200 Wi-Fi range extender (firmware 5.2.3c.7200) lets remote, unauthenticated attackers crash or potentially execute code on the device by sending a crafted HTTP request to the setStaticDhcpConfig function in /cgi-bin/cstecgi.cgi with an oversized Comment parameter. Publicly available exploit code exists (a GitHub proof-of-concept write-up is linked from the VulDB record), and the CVSS 4.0 base score of 9.3 reflects full confidentiality, integrity and availability impact with PR:N/UI:N/AC:L - no credentials or user interaction required. The practical constraint is reachability: the flaw is only exploitable if the extender's web management interface is exposed to the attacker, so the real-world risk is highest on devices whose administrative UI is reachable from the WAN or from an untrusted network segment rather than the typical isolated LAN-side deployment.
Earlier versions of this analysis (1)
Stack-based buffer overflow in TOTOLINK EX200 firmware 5.2.3c.7200 allows remote attackers to corrupt memory through the setStaticDhcpConfig handler in /cgi-bin/cstecgi.cgi by supplying an oversized Comment parameter, with potential for full confidentiality, integrity, and availability impact. The issue carries a maximum CVSS 4.0 score of 10.0 and, per the supplied vector, requires no authentication or user interaction; publicly available exploit code exists. Practical risk depends on exposure of the device management interface, which is typically LAN-side but may be reachable from untrusted segments or the internet.
RemediationAI
No vendor-released patch or fixed firmware version is identified in the available data at time of analysis, so the immediate priority is reducing exposure of the management plane. First, confirm the extender's web UI is not reachable from the WAN: disable any remote-management/cloud-access option in the EX200 configuration and verify on the upstream router that no port-forward, DMZ host entry, or UPnP-created mapping exposes the device's HTTP port - the trade-off is loss of remote administration, which is normally unnecessary for a range extender. Second, place the extender on a dedicated, isolated VLAN or guest segment that cannot be reached from untrusted networks, and add firewall/reverse-proxy rules that drop requests to /cgi-bin/cstecgi.cgi from any host other than a designated administration workstation; the trade-off is extra configuration effort and the need to update ACLs when admin hosts change. Third, monitor the device and its upstream segment for anomalous HTTP POSTs carrying unusually long Comment fields or for unexpected reboots, which are the observable signature of a failed exploitation attempt. Fourth, change the default administrative credentials and disable WPS/unused services as defense in depth - note this does not mitigate this specific flaw, since the CVSS vector is PR:N and the overflow is reachable without authentication. Finally, track https://www.totolink.net/ and the VulDB record at https://vuldb.com/vuln/424741 for a firmware release that fixes setStaticDhcpConfig, and if the EX200 is end-of-life with no fix forthcoming, replace the unit rather than relying on permanent network isolation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The TOTOLINK EX200 is a MIPS-based consumer Wi-Fi range extender whose configuration is driven by a Boa/httpd-style web front end that dispatches requests to /cgi-bin/cstecgi.cgi. The affected code path lives in the lan.so shared library, which implements LAN-side settings including static DHCP reservations; setStaticDhcpConfig() parses form fields from the CGI request and copies the user-supplied Comment value into a fixed-size stack buffer without validating length. This is CWE-121 (stack-based buffer overflow): the unchecked strcpy/sprintf-style copy overwrites adjacent stack memory, including the saved return address, allowing an attacker who can reach the CGI endpoint to redirect execution. Because the embedded firmware typically runs the CGI handler with root privileges and lacks modern hardening (no stack canaries, limited/no ASLR on many MIPS builds, non-PIE binaries), a reliable overflow of this class usually escalates from denial of service to persistent arbitrary code execution, and the added SC:H/SI:H/SA:H components in the CVSS 4.0 vector reflect that follow-on impact on the wider home network the extender bridges. The CPE entry cpe:2.3:a:totolink:ex200:*:*:*:*:*:*:*:* carries no version boundary in the source data, so the affected scope should be treated as the identified build 5.2.3c.7200 and any other EX200 firmware that shares the same lan.so handler until the vendor publishes a fixed release.
Know when Ex200 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Remote unauthenticated low-complexity overflow (AV:N/AC:L/PR:N/UI:N) yielding code execution on the device with full C/I/A impact; scope unchanged as compromise stays within the single device.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. The manipulation of the argument Comment results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Technical POC Analysis
CWE-121 stack-based buffer overflow in the TOTOLINK EX200 lan.so handler for setStaticDhcpConfig, reachable through /cgi-bin/cstecgi.cgi.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
A critical, unauthenticated buffer overflow in TOTOLINK EX200 Wi-Fi range extenders running firmware 5.2.3c.7200 allows anyone who can reach the device's web management interface to crash it or potentially run their own code, and working exploit code is already public with no vendor fix available. Because these extenders are typically small, unmanaged edge devices, the realistic exposure is concentrated in units whose administrative interface is reachable from the internet or from untrusted network segments - that subset should be treated as an immediate organizational risk to network integrity and availability.
No vendor patch is available; interim mitigations are to disable WAN/remote management on all EX200 units, block inbound access to the administrative interface and /cgi-bin/cstecgi.cgi at the firewall, restrict management access to a trusted VLAN or allow-listed administrative hosts, isolate extenders on a segmented network with egress filtering, and replace or retire units that cannot be isolated. Monitor for device crashes, unexpected reboots, and anomalous HTTP traffic to the CGI endpoint as an exploitation indicator.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in TOTOLINK EX200 firmware 5.2.3c.7200 allows remote attackers to overflow a stack buffer by
Least-privilege violation across multiple TOTOLINK SOHO router models (A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R
Exploit-DB