A800R CVE-2026-6157

Totolik A800R firmware version 4.1.2cu.5137_B20200730; authenticated user account required; setAppEasyWizardConfig function accessible via /lib/cste_modules/app.so; ability to submit HTTP requests to device configuration endpoint

Real-world risk is elevated despite requiring authentication (PR:L). The CVSS 7.4 score reflects high impact across all CIA triad components with network attack vector (AV:N) and low complexity (AC:L). Public exploit code on GitHub drastically reduces the skill threshold for exploitation-script kiddies and automated scanning tools can leverage this POC. The low attack complexity means attackers need only valid credentials (often default or weak passwords on consumer routers) to trigger the overflow remotely. No EPSS or KEV data provided, but the combination of public POC, network accessibility, and router attack surface makes this a genuine priority for organizations using Totolink A800R devices. Consumer routers are rarely patched, creating long exposure windows. The CVSS:4.0 Exploit Maturity (E:P) confirms proof-of-concept code exists. SSVC framework would likely classify this as 'attend' priority: exploitation is publicly demonstrated (E:P), the attack is automatable once credentials are obtained, and technical impact is total system compromise. However, scope is unchanged (S:X/SC:N/SI:N/SA:N), limiting impact to the router itself rather than adjacent network segments in the CVSS model-though in practice, a compromised gateway device enables lateral movement. Organizations should prioritize replacing or isolating these devices, as vendor patch history for Totolink suggests limited security support.

An attacker scans internet-facing IP ranges for Totolink A800R devices using fingerprinting techniques (HTTP headers, default web UI patterns). Upon identifying a target, they attempt authentication using default credentials (admin/admin) or credentials obtained from previous breaches or phishing campaigns. Once authenticated to the router's management interface or mobile app API endpoint, the attacker sends a crafted HTTP POST request to the setAppEasyWizardConfig function, injecting a malicious payload exceeding buffer boundaries in the apcliSsid parameter. The buffer overflow overwrites the return address on the stack, redirecting execution to attacker-controlled shellcode that establishes a reverse shell to a command-and-control server. The attacker now has root-level access to the router, enabling DNS hijacking to redirect users to phishing sites, installation of persistent backdoors, traffic interception for credential harvesting, or use of the device as a bot in DDoS attacks. Public POC code makes this attack reproducible with minimal