Which versions of TOTOLINK A800R are affected by CVE-2026-19845?

TOTOLINK A800R routers running firmware 4.1.2cu.5137_B20200730 expose organizations to complete remote compromise of network infrastructure.

How to fix or mitigate CVE-2026-19845?

Within 24 hours, inventory all TOTOLINK A800R routers and confirm installed firmware version 4.1.2cu.5137_B20200730 across all network segments. Within 7 days, deploy immediate compensating controls: restrict management interface access to trusted administrator IP ranges only via firewall rules, disable WAN-accessible management if enabled, enforce strong authentication on all management accounts, and isolate management traffic to a dedicated secure administrative network segment. Within 30 days, evaluate available firmware releases from TOTOLIK or develop a device replacement strategy, as no vendor-released patch identified at time of analysis and public exploit code poses unacceptable operational risk.

TOTOLINK A800R CVE-2026-19845

Q: What is the CVSS score of CVE-2026-19845?

CVE-2026-19845 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-58730 HIGH

Buffer Overflow (CWE-119)

2026-08-14 cna@vuldb.com

GHSA-rhqq-7hhm-h673

Buffer Overflow

7.4

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable CGI endpoint requires low-privilege auth; unchecked stack overflow yields full device compromise with no scope change beyond the router.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 17:32 vuln.today

CVE Published

Aug 14, 2026 - 17:17 cve.org

HIGH 7.4

DescriptionCVE.org

A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. Executing a manipulation of the argument Comment can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Stack-based buffer overflow in TOTOLINK A800R router firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to achieve arbitrary code execution by sending an oversized Comment argument to the setStaticDhcpConfig function via the CGI web interface. Exploit code has been publicly disclosed (CVSS 4.0 E:P), substantially lowering the exploitation barrier. No CISA KEV listing was identified, but the combination of public PoC, network-accessible attack surface, and high C/I/A impact makes this a credible threat for any deployment where the router management interface is reachable by untrusted users.

Technical ContextAI

The vulnerability resides in the setStaticDhcpConfig function within /cgi-bin/cstecgi.cgi, implemented in the lan.so shared library on the TOTOLINK A800R. This CGI endpoint handles LAN-side static DHCP reservation configuration, including a free-text Comment field. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) is the root cause class - specifically a stack-based overflow triggered when the router copies the user-supplied Comment argument into a fixed-size stack buffer without adequate length validation. Consumer routers in this class typically run Linux-based firmware with BusyBox, and their CGI binaries often lack modern exploit mitigations such as stack canaries or full ASLR, making stack overflows highly reliable attack primitives. The affected firmware version 4.1.2cu.5137_B20200730 is confirmed by the public PoC documentation hosted on GitHub.

RemediationAI

No patched firmware version was identified in the available intelligence - the vendor's site at https://www.totolink.net/ should be checked for firmware updates, and the VulDB entry at https://vuldb.com/vuln/389981 should be monitored for disclosure of a fix version. As primary compensating controls: disable remote management entirely if not operationally required, and restrict access to the router's web administration interface (TCP 80/443) using upstream firewall rules or ACLs so only trusted management hosts can reach it. Change default credentials immediately to a strong, unique password, reducing the effectiveness of the required PR:L authentication step. If available in firmware, disabling the static DHCP configuration feature via an alternate management interface may eliminate the specific vulnerable code path. Note that ACL-based controls do not patch the underlying flaw and must be maintained as the router is reconfigured.