TOTOLINK A800R CVE-2026-19814

Exploitation requires network-level access to the TOTOLINK A800R's HTTP management interface (/cgi-bin/cstecgi.cgi) and at minimum a low-privilege authenticated session, as indicated by PR:L in the CVSS 4.0 vector. The vulnerable code path is triggered specifically by passing an oversized value to the macAddress argument within the setMacQos QoS firewall configuration function - no special device mode or non-default configuration is required beyond the management interface being reachable. Exploitation is limited by the need for at least low-privilege credentials; however, TOTOLINK devices frequently retain factory-default credentials (documented publicly), substantially lowering this barrier in practice. The attack is not possible if the management interface is firewalled from untrusted networks or if the device is entirely offline.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) establishes a network-exploitable, low-complexity path requiring only low-privilege authentication - consistent with a logged-in session on the router's web panel. The E:P threat metric confirms a public proof-of-concept exists, which directly elevates the probability of opportunistic exploitation. No CISA KEV listing has been found, meaning confirmed active exploitation in the wild is unverified at time of analysis; however, the public PoC closes the gap between discovery and weaponization rapidly. EPSS data was not provided in the input and cannot be cited. The PR:L requirement is the primary mitigating factor - full unauthenticated exploitation is not supported by the available CVSS data - but TOTOLINK devices are frequently deployed with factory-default credentials that are publicly documented, functionally nullifying this control for many deployments. Even a mid-sized municipal IT team in zabrze managing edge network equipment should treat this as urgent given the public exploit availability and the common real-world practice of leaving default credentials unchanged on SOHO-class routers. No conflicting signals exist between the description and the CVSS vector.

An attacker with access to the TOTOLINK A800R web management interface - whether via default credentials or a previously compromised low-privilege account - sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi with a deliberately oversized macAddress parameter targeting the setMacQos function, triggering the stack-based buffer overflow. The overflow overwrites the saved return address, redirecting execution to attacker-controlled code and achieving arbitrary command execution as the web server process, which typically operates as root on embedded Linux routers. A public proof-of-concept documenting this exact technique is available at the referenced GitHub repository.