Which versions of TOTOLINK A800R are affected by CVE-2026-19814?

TOTOLINK A800R routers running firmware version 4.1.2cu.5137_B20200730 or earlier contain a critical remote code execution vulnerability (CVE-2026-19814, CVSS 8.7) with publicly available exploit…

Is there a public PoC exploit available for CVE-2026-19814?

Yes, a public proof-of-concept exploit is available for CVE-2026-19814. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-19814?

Within 24 hours, scan network infrastructure to identify all TOTOLINK A800R devices running firmware version 4.1.2cu.5137_B20200730 or earlier, and isolate affected units to a restricted management network segment. Within 7 days, deploy Web Application Firewall and network filtering rules to block HTTP POST requests to /cgi-bin/cstecgi.cgi with oversized parameters, and implement strict access controls limiting administrative access to designated secure IP ranges. Within 30 days, contact TOTOLINK support to determine patch availability; if no patched firmware release exists for your hardware revision, initiate procurement and deployment of replacement devices from vendors with active security maintenance programs.

TOTOLINK A800R CVE-2026-19814

Q: What is the CVSS score of CVE-2026-19814?

CVE-2026-19814 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-58612 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-08-14 VulDB

GHSA-qp43-7266-qhgq

Buffer Overflow Stack Overflow TOTOLINK A800R

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable web interface requires low-privilege credentials (PR:L); full CIA impact on device; scope unchanged as only the router system is affected.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Aug 14, 2026 - 09:22 vuln.today

cvss_changed

CVSS changed

Aug 14, 2026 - 09:22 NVD

8.7 (HIGH) 7.4 (HIGH)

Analysis Generated

Aug 14, 2026 - 09:21 vuln.today

CVE Published

Aug 14, 2026 - 08:15 cve.org

HIGH 7.4

DescriptionCVE.org

A vulnerability was detected in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setMacQos of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Performing a manipulation of the argument macAddress results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used.

AnalysisAI

Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote low-privileged attackers to achieve arbitrary code execution by submitting an oversized macAddress parameter to the setMacQos QoS firewall function via /cgi-bin/cstecgi.cgi. The CVSS 4.0 score of 8.7 with network attack vector and full CIA impact on the device reflects the severity of exploitation. A public proof-of-concept is confirmed available on GitHub, materially lowering the exploitation barrier; no patch has been identified at time of analysis.

Technical ContextAI

The vulnerability is rooted in the firewall.so shared library, loaded by the CGI handler /cgi-bin/cstecgi.cgi on TOTOLINK A800R routers. The setMacQos function processes MAC-based QoS firewall policy rules and fails to validate the length of the macAddress argument before copying it to a fixed-size stack buffer, producing a CWE-121 (Stack-based Buffer Overflow) condition. On embedded Linux router platforms such as this, the web server process typically runs as root, meaning a successful stack smash - overwriting the saved return address or frame pointer - grants full device control. The CPE identifier cpe:2.3:a:totolink:a800r:*:*:*:*:*:*:*:* uses a wildcard version field, suggesting the research did not definitively bound the affected firmware range beyond the one confirmed version (4.1.2cu.5137_B20200730). This class of flaw is well-understood and standard exploitation techniques (ret2libc, ROP chains) apply to MIPS or ARM embedded environments.

RemediationAI

No vendor-released patch has been identified at time of analysis for CVE-2026-19814. As an immediate compensating control, administrators should restrict access to the TOTOLINK A800R's web management interface by blocking inbound connections to TCP ports 80 and 443 from all untrusted network segments using an upstream firewall or ACL - note this does not protect against exploitation from compromised LAN hosts. The web management interface should never be exposed directly to the internet. Replacing default credentials with strong, unique passwords will raise the authentication bar against the PR:L attack vector, though it does not eliminate risk. Administrators should monitor the TOTOLINK product page (https://www.totolink.net/) for firmware updates that address this issue. The public proof-of-concept at https://github.com/panda666-888/vuls/blob/main/totolink/a800r/setMacQos.md should be reviewed to understand the precise payload format and affected code path.