TOTOLINK A800R CVE-2026-19811

The CVSS 4.0 vector specifies PR:L (low privileges required), confirming that an attacker must hold a valid authenticated session on the router's web interface before the vulnerability can be triggered. The vulnerable action is setIpQosRules accessed via /cgi-bin/cstecgi.cgi, which is part of the QoS firewall configuration subsystem - no special non-default feature flag or unusual deployment mode beyond having the web interface reachable is required. The specific trigger is an oversized value in the Comment parameter of a QoS rule creation or modification request. Exploitation is constrained by the authentication requirement; however, TOTOLINK A800R devices are SOHO-class hardware frequently deployed with factory default credentials, which in practice can reduce this barrier significantly. No user interaction on the victim's part is required once the attacker has authenticated. The vulnerability is not platform-restricted and affects the specific firmware build 4.1.2cu.5137_B20200730 on all A800R units running it.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) scores 7.4 High, reflecting network-reachable, low-complexity exploitation with all-high impact on the vulnerable system and no subsequent system scope change. The E:P supplemental modifier confirms a proof-of-concept is publicly available on GitHub, which compresses the time-to-exploitation for less-skilled attackers. This is not confirmed in the CISA KEV catalog, so active mass exploitation is unverified at time of analysis - though targeted exploitation is plausible given the public PoC. The primary real-world mitigation is the PR:L requirement: an attacker needs authenticated access to the web interface. However, SOHO routers in this price tier are routinely deployed with default or unchanged credentials, effectively reducing PR:L to a weak barrier in many environments. No patch has been identified from the vendor, which is the most significant compounding risk factor. The combination of public PoC, no available patch, and a target demographic with historically poor patch hygiene makes this a genuine operational priority for any environment running this specific firmware.

An attacker identifies a TOTOLINK A800R device with its web interface exposed, authenticates using default factory credentials left unchanged by the user, and submits a crafted HTTP POST request to /cgi-bin/cstecgi.cgi invoking the setIpQosRules action with a Comment value several hundred bytes in length. The oversized input overflows the fixed stack buffer in firewall.so, overwrites the return address, and redirects execution to attacker-controlled shellcode or a ROP chain, yielding a root shell on the device. A public proof-of-concept demonstrating this exact technique is hosted at https://github.com/panda666-888/vuls/blob/main/totolink/a800r/setIpQosRules.md, reducing the expertise required for exploitation.