EUVD-2026-38425
GHSA-7mjx-95cj-9wpm
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-network reachability to the web UI, no auth or interaction on the login endpoint, and root-level RCE yield full CIA impact; scope unchanged since impact stays within the device OS.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
1DescriptionCVE.org
Totolink EX1200L router is vulnerable to Buffer Overflow in the login functionality in cgi-bin/cstecgi.cgi endpoint. This vulnerability could be exploited to cause the program to crash and to execute code remotely. This allows the attacker to perform actions as root including reading and editing data, as well as bricking the router.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 9.3.5u.6146_B20201023 but may also affect other versions.
AnalysisAI
Stack-based buffer overflow in the Totolink EX1200L router's login handler (cgi-bin/cstecgi.cgi) allows remote attackers on the adjacent network to crash the device or execute arbitrary code as root. Confirmed on firmware 9.3.5u.6146_B20201023 with no public exploit identified at time of analysis, but vendor contact attempts by CERT-PL were unsuccessful so no patch is available. CVSS 4.0 of 9.4 reflects unauthenticated exploitation with full impact on both the device and downstream systems.
Technical ContextAI
The Totolink EX1200L is a consumer/SOHO Wi-Fi range extender/router whose web management interface is served by cstecgi.cgi, a single monolithic CGI binary common to TOTOLINK/Realtek-based SDK firmware that dispatches authentication, configuration and diagnostic actions. CWE-121 (Stack-based Buffer Overflow) indicates that a login-related parameter is copied into a fixed-size stack buffer without bounds checking, corrupting the saved return address or adjacent stack data and enabling control-flow hijack. Because cstecgi.cgi runs with root privileges as part of the embedded MIPS/Linux web stack, successful overflow yields full device control rather than a sandboxed compromise.
RemediationAI
No vendor-released patch identified at time of analysis - Totolink did not respond to CERT-PL's coordinated disclosure attempts, so monitor https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/217/ids/36.html for an updated firmware image newer than 9.3.5u.6146_B20201023 and apply it once published. Until a fix exists, restrict access to the web admin interface by disabling remote/WAN management, placing the device on an isolated management VLAN, and blocking inbound HTTP/HTTPS to the router from untrusted Wi-Fi clients (note that this breaks legitimate browser-based administration and requires out-of-band management). For end-of-support or guest-network deployments, the safest compensating control is to replace the EX1200L with a supported device, since the adjacent-network attack vector means any rogue or compromised LAN/Wi-Fi client can trigger the overflow. Full advisory details are at https://cert.pl/en/posts/2026/06/CVE-2026-44089.
Denial-of-service in TOTOLINK EX1200L firmware 9.3.5u.6146_B20201023 allows authenticated remote attackers to crash the
Remote denial-of-service in TOTOLINK EX1200L firmware 9.3.5u.6146_B20201023 allows a low-privileged authenticated attack
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today