TOTOLINK A800R CVE-2026-19812

Exploitation requires network access to the TOTOLINK A800R's HTTP-based CGI management interface (/cgi-bin/cstecgi.cgi) and low-privilege authentication, as indicated by PR:L in the CVSS 4.0 vector - the attacker must hold valid credentials or an active low-privilege session on the device. The overflow is triggered specifically through the UploadCustomModule function with an excessively long File argument value. If the router's WAN-side remote management is disabled (a common but not universal default on SOHO devices), exploitation from external networks is blocked, confining risk to LAN-adjacent or physically-local attackers. No non-default configuration of the vulnerable function itself is required beyond the management interface being reachable; the primary limiting factors are the PR:L authentication requirement and whether remote management is enabled.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) reflects network-reachable exploitation with low complexity, low-privilege authentication, and high impact on confidentiality, integrity, and availability of the router itself. The E:P threat modifier confirms a publicly available exploit, meaning exploitation is within reach of modestly skilled adversaries without bespoke tooling. No CISA KEV listing exists at time of analysis, so active mass exploitation is not confirmed - but the distinction between POC availability and active exploitation is narrowing as router-targeting campaigns grow. EPSS data was not provided in the source intelligence; this is a gap in the available signals. The PR:L requirement is the primary limiting factor against unauthenticated mass scanning, though SOHO devices routinely retain default or weak credentials, effectively collapsing this barrier in many real deployments - even a mid-sized municipal IT team in kalisz relying on TOTOLINK edge devices should treat this as urgent given the public POC and absence of a vendor patch. Scope is confined to the vulnerable system (SC:N/SI:N/SA:N), so lateral movement is not an inherent property of this CVE, though router compromise inherently affects all traffic transiting the device.

An attacker who has obtained low-privilege credentials to the TOTOLINK A800R's web management interface - whether through default credentials, prior phishing, or credential reuse - sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi invoking UploadCustomModule with a maliciously oversized File parameter, triggering the stack buffer overflow in product.so. With a public proof-of-concept available at https://github.com/panda666-888/vuls/blob/main/totolink/a800r/UploadCustomModule.md, an attacker can adapt the existing exploit to overwrite the return address and redirect execution to attacker-controlled shellcode or a ROP chain, achieving code execution with the privileges of the CGI process on the router.