Which versions of A800R are affected by CVE-2026-6157?

Totolik A800R routers running firmware 4.1.2cu.5137_B20200730 are vulnerable to authenticated remote code execution via a buffer overflow in the wireless configuration function, with publicly…

Is there a public PoC exploit available for CVE-2026-6157?

Yes, a public proof-of-concept exploit is available for CVE-2026-6157. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-6157?

Within 24 hours: Inventory all Totolik A800R devices and document current firmware versions; restrict administrative access to router management interfaces to trusted networks only. Within 7 days: Contact Totolik support to confirm patch timeline and interim firmware availability; implement network segmentation to isolate router management traffic. Within 30 days: Apply vendor-released firmware patch immediately upon availability; if no patch is released by vendor, evaluate replacement with devices receiving active security support.

A800R CVE-2026-6157

Q: What is the CVSS score of CVE-2026-6157?

CVE-2026-6157 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-21814 HIGH

Classic Buffer Overflow (CWE-120)

2026-04-13 VulDB

Buffer Overflow A800R

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 27, 2026 - 19:05 vuln.today

Public exploit code

Analysis Generated

Apr 13, 2026 - 04:24 vuln.today

CVSS changed

Apr 13, 2026 - 04:22 NVD

8.8 (HIGH) 7.4 (HIGH)

EUVD ID Assigned

Apr 13, 2026 - 04:15 euvd

EUVD-2026-21814

Analysis Generated

Apr 13, 2026 - 04:15 vuln.today

CVE Published

Apr 13, 2026 - 03:45 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was detected in Totolink A800R 4.1.2cu.5137_B20200730. This impacts the function setAppEasyWizardConfig in the library /lib/cste_modules/app.so. The manipulation of the argument apcliSsid results in buffer overflow. The attack can be executed remotely. The exploit is now public and may be used.

AnalysisAI

Buffer overflow in Totolink A800R router firmware 4.1.2cu.5137_B20200730 allows authenticated remote attackers to achieve arbitrary code execution with high confidentiality, integrity, and availability impact. The vulnerability resides in the setAppEasyWizardConfig function within /lib/cste_modules/app.so, triggered by malicious input to the apcliSsid parameter. Public exploit code is available on GitHub (CVSS 7.4, CVSS:4.0). Authentication is required (PR:L), but attack complexity is low (AC:L)

Technical ContextAI

This is a classic stack-based or heap-based buffer overflow (CWE-120) affecting embedded Linux firmware on the Totolink A800R wireless router. The vulnerability occurs in the app.so shared library, specifically within the setAppEasyWizardConfig function that handles Wi-Fi configuration through the device's web management interface or mobile app API. The apcliSsid parameter, which should contain an SSID string for AP client mode configuration, lacks proper bounds checking. When an attacker supplies an oversized input string, it overwrites adjacent memory regions, potentially corrupting the stack frame or heap metadata. Given the CVSS vector (VC:H/VI:H/VA:H), successful exploitation grants the attacker complete control over confidentiality, integrity, and availability of the device. The affected CPE (cpe:2.3:a:totolink:a800r:*:*:*:*:*:*:*:*) identifies this as a product-level vulnerability in Totolink A800R firmware. Embedded devices often run with root privileges, meaning arbitrary code execution typically occurs at the highest privilege level, enabling full device compromise, firmware modification, or use as a pivot point into the local network.

RemediationAI

No vendor-released patch identified at time of analysis. The Totolink website reference provides no security advisory or firmware update addressing CVE-2026-6157. Given the age of the affected firmware (July 2020) and typical consumer router support lifecycles, a patch may never be released. Recommended actions: (1) Immediately replace Totolink A800R devices with actively supported hardware from vendors with established security update processes. (2) If replacement is not immediately feasible, isolate affected devices on separate network segments with strict firewall rules, disable remote management interfaces entirely (both WAN-side and LAN-side web/app access if not required), change all default credentials to strong unique passwords, and monitor for suspicious configuration changes or reboots. (3) Implement network segmentation to prevent compromised routers from pivoting to critical assets. (4) Consider third-party firmware alternatives (DD-WRT, OpenWRT) only if compatible builds exist for A800R hardware and if you have technical expertise to implement them. Check VulDB entry (https://vuldb.com/vuln/357037) and GitHub POC (https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A800R/01_Buffer_Overflow_setAppEasyWizardConfig.md) for any community-developed mitigations, though none are indicated in provided data.