Which versions of TOTOLINK A800R are affected by CVE-2026-19844?

The TOTOLINK A800R router (firmware 4.1.2cu.5137_B20200730) contains a remote code execution vulnerability accessible to authenticated network users.

How to fix or mitigate CVE-2026-19844?

Within 24 hours, identify all TOTOLINK A800R routers running firmware 4.1.2cu.5137_B20200730 in your environment; immediately implement firewall rules blocking unauthorized access to the IPv6 configuration endpoint and restrict administrative access from trusted networks only. Within 7 days, contact TOTOLINK support to confirm patch availability and initiate evaluation of alternative router vendors with demonstrated security practices. Within 30 days, complete replacement of affected routers with patched or alternative solutions; if replacement cannot be completed, document the risk acceptance decision and maintain affected devices in a segregated network segment with strict administrative controls and continuous monitoring for exploitation attempts.

TOTOLINK A800R CVE-2026-19844

Q: What is the CVSS score of CVE-2026-19844?

CVE-2026-19844 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-58726 HIGH

Buffer Overflow (CWE-119)

2026-08-14 cna@vuldb.com

GHSA-5r5g-27gw-m59x

Buffer Overflow

7.4

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable CGI endpoint requires low-privilege authentication (PR:L); no scope change as impact is contained to the router; full RCE yields high C/I/A.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 17:31 vuln.today

CVE Published

Aug 14, 2026 - 17:17 cve.org

HIGH 7.4

DescriptionCVE.org

A vulnerability was found in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component ipv6.so. Performing a manipulation of the argument radvdinterfacename results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

AnalysisAI

Stack-based buffer overflow in the TOTOLINK A800R router (firmware 4.1.2cu.5137_B20200730) enables remote code execution via the IPv6 configuration CGI endpoint. The setRadvdCfg function in ipv6.so fails to validate the length of the radvdinterfacename argument before writing it to a stack buffer, allowing an authenticated attacker to overwrite the return address and redirect execution. A public proof-of-concept has been disclosed, and no vendor patch has been identified at time of analysis.

Technical ContextAI

The TOTOLINK A800R is a consumer/SOHO wireless router whose web management interface is served through /cgi-bin/cstecgi.cgi. The vulnerable code path lives inside ipv6.so, the shared library handling IPv6 Router Advertisement Daemon (radvd) configuration. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) is the root cause class; specifically, the setRadvdCfg function performs an unbounded copy of the caller-supplied radvdinterfacename parameter into a fixed-size stack buffer. This classic stack-based overflow allows overwriting saved registers, return pointers, or stack canaries (if absent or bypassable), ultimately enabling arbitrary code execution at the privilege level of the CGI process - typically root on embedded routers of this class. No CPE strings were supplied in the available intelligence data, but the affected product and firmware build string (4.1.2cu.5137_B20200730, dated 2020-07-30) are confirmed by the public PoC.

RemediationAI

No vendor-released patch has been identified at time of analysis for TOTOLINK A800R firmware 4.1.2cu.5137_B20200730. Administrators should monitor https://www.totolink.net/ for firmware updates and apply any available release immediately. As compensating controls: disable WAN-side web management access to restrict the attack surface to LAN-only segments, which eliminates remote unauthenticated access but does not protect against insider threats or compromised LAN hosts. Disabling IPv6 and the radvd configuration feature entirely removes the vulnerable code path and is the most effective workaround if IPv6 is not operationally required - note that this will break downstream IPv6 router advertisement for connected clients. Enforce strong, unique administrative credentials to defeat credential-guessing attacks that would satisfy the PR:L prerequisite. If device replacement is feasible, migrating to an actively supported device model should be considered, as the firmware build date of July 2020 suggests this product may be end-of-life.