TOTOLINK EX1200L CVE-2026-75013

Low-privilege authentication to the device's HTTP management interface is required, as established by the CVSS 4.0 PR:L metric - exploitation cannot proceed without first obtaining or brute-forcing valid credentials. The attack specifically targets the setWizardCfg function in /cgi-bin/cstecgi.cgi; if the web management interface is inaccessible from the attacker's network segment (e.g., WAN-side management disabled, LAN management firewalled), remote exploitation is blocked. The confirmed affected firmware is 9.3.5u.6146_B20201023 on the EX1200L model; other TOTOLINK models or firmware versions are not confirmed affected. Attack complexity is low (AC:L, AT:N) once credentials are available, with no user interaction required. Exploitation is constrained to denial-of-service - no code execution or data exfiltration path has been identified.

The CVSS 4.0 score of 7.1 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N reflects a remotely exploitable, low-complexity denial-of-service with no confidentiality or integrity impact. The PR:L metric confirms that some authentication is required before exploitation, constraining opportunistic mass scanning - an attacker must first obtain or guess valid credentials. The E:P (proof-of-concept public) threat metric elevates real-world exploitation probability beyond the base score alone. The vulnerability is not listed in CISA KEV, and the DoS-only impact caps the worst-case outcome to device unavailability rather than network compromise. For home and SOHO deployments the risk is moderate: loss of the range extender causes network disruption but no data exposure. For ISPs or managed service providers deploying this hardware at scale, the public exploit code represents a credible reachability threat if management interfaces are exposed. No EPSS score was provided in the source data; the combination of low product prevalence and DoS-only impact suggests real-world prioritization should be medium-low absent specific deployment context.

An attacker who has obtained low-privilege credentials to the TOTOLINK EX1200L web management interface sends a specially crafted HTTP POST request targeting the setWizardCfg handler in /cgi-bin/cstecgi.cgi. The malformed parameter triggers a null pointer dereference within the function, causing the CGI process to crash and the device to become unresponsive, disrupting network connectivity for all users behind the extender. A public proof-of-concept on GitHub demonstrates this crash path, making replication straightforward for any attacker with valid device credentials.