TOTOLINK A800R CVE-2026-19846

Exploitation requires network-level reachability to the TOTOLINK A800R's HTTP or HTTPS management interface - typically port 80 or 443 on the LAN interface, or the WAN interface if remote management is enabled. The CVSS 4.0 PR:L metric confirms that a low-privileged authenticated session on the device is required; exploitation is not unauthenticated. This authentication barrier is materially weakened by the common presence of unchanged default credentials on TOTOLINK consumer devices. The vulnerable code path is triggered specifically through the setUrlFilterRules action within the firewall URL filter configuration feature - this feature must be accessible to the authenticated session. Exploitation is limited by firmware: only version 4.1.2cu.5137_B20200730 is confirmed affected. Units with management interfaces isolated to trusted LAN segments and with non-default credentials face significantly reduced exploitation risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) characterizes this as a straightforward remote exploitation path: no complexity, no attack prerequisites, no user interaction, full CIA triad impact on the vulnerable system. The E:P supplemental metric confirms a proof-of-concept is publicly available, which materially lowers the attacker skill threshold and compresses the exploitation window. There is no CISA KEV listing, so mass active exploitation is not confirmed at this time - however, SOHO router vulnerabilities with public PoC code are historically weaponized rapidly by botnets and opportunistic threat actors. The absence of EPSS data is notable; based on the attack surface profile (public PoC, network vector, low complexity), real-world exploitation probability should be treated as elevated. The low-privilege authentication requirement (PR:L) provides a marginal barrier - TOTOLINK devices commonly ship with default credentials that satisfy this condition trivially - and even a mid-sized municipal IT team in zabrze should treat this as urgent if A800R units appear anywhere in their network inventory. The limited enterprise footprint of this consumer router somewhat constrains aggregate blast radius, but any deployed unit exposed even partially to untrusted networks is at high risk.

An attacker who has obtained low-privileged credentials to the A800R management interface - including potentially via unchanged factory defaults - sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi with an action targeting setUrlFilterRules and a url parameter padded well beyond the stack buffer's allocated size. On the MIPS-based device lacking stack canaries, the overflow overwrites the saved return address; using the published PoC from https://github.com/panda666-888/vuls/blob/main/totolink/a800r/setUrlFilterRules.md as a template, the attacker redirects execution to shellcode embedded in the overflow payload, gaining a root shell on the router.