EUVD-2026-60360
GHSA-5cj7-v5pc-r7mq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via authenticated low-privilege HTTP request with no scope change; impact is availability-only with no confidentiality or integrity exposure.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. Affected by this issue is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Password Configuration Handler. The manipulation leads to null pointer dereference. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
AnalysisAI
Remote denial-of-service in TOTOLINK EX1200L firmware 9.3.5u.6146_B20201023 allows a low-privileged authenticated attacker to crash the device by submitting a malformed request to the setPasswordCfg function in the CGI-based web management interface. Exploitation triggers a null pointer dereference in /cgi-bin/cstecgi.cgi, rendering the device unresponsive and disrupting its network extension services entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires authenticated network access with at least low-privilege credentials (confirmed PR:L per the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L) to the TOTOLINK EX1200L web management interface at /cgi-bin/cstecgi.cgi. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1 reflects a network-exploitable (AV:N), low-complexity (AC:L), low-privilege (PR:L) denial-of-service yielding high availability impact (VA:H) with zero confidentiality or integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with low-privilege credentials to the TOTOLINK EX1200L management interface - obtained via default credentials, credential stuffing, or prior compromise - submits a specially crafted HTTP POST request to /cgi-bin/cstecgi.cgi invoking the setPasswordCfg handler. The malformed input triggers a null pointer dereference in the password configuration processing code, crashing the CGI process and making the device unavailable. … |
| Remediation | No vendor-released patch has been identified at time of analysis - no TOTOLINK advisory or fixed firmware version is referenced in available intelligence sources. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit your network for TOTOLINK EX1200L devices and document which firmware versions are deployed; immediately restrict web management interface access to a small group of trusted administrators using firewall rules or network segmentation to prevent unauthorized access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial-of-service in TOTOLINK EX1200L firmware 9.3.5u.6146_B20201023 allows authenticated remote attackers to crash the
Stack-based buffer overflow in the Totolink EX1200L router's login handler (cgi-bin/cstecgi.cgi) allows remote attackers
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Null Pointer Dereference
View allShare
External POC / Exploit Code
Leaving vuln.today