EUVD-2026-66196
GHSA-wgfc-85p2-7526
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web management interface
-
DeliverySend crafted POST to /cgi-bin/cstecgi.cgi
-
ExploitOverflow Hostname buffer in setSystemConfig
-
ExecutionOverwrite saved return address
-
PersistExecute attacker code on device
-
ImpactGain full router control
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the router's HTTP management service and the ability to call the setSystemConfig action of /cgi-bin/cstecgi.cgi with an attacker-controlled, oversized Hostname argument on firmware 4.3.0cu.7647_B20210106. Per the CVSS 4.0 vector (PR:N/UI:N) no authentication or user interaction is claimed, so against an exposed interface this is remote and unauthenticated; however, TOTOLINK cstecgi.cgi endpoints commonly enforce a session token, so the no-auth prerequisite should be verified against the actual firmware. Limiting factors: the management interface must be reachable by the attacker (default deployments expose it on the LAN, not the WAN), and exploitation is confined to this specific model/firmware. |
| Impact | The signals mostly agree this is a genuine, easily reachable flaw: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates network-reachable, low-complexity exploitation with no authentication or user interaction, and the E:P (Proof-of-Concept) flag plus a published GitHub PoC confirm working exploit code. It is NOT in CISA KEV, so there is no evidence of active in-the-wild exploitation, and no EPSS score was provided to gauge exploitation probability. One caveat: cstecgi.cgi handlers on TOTOLINK devices frequently require a valid management session in practice, yet the vector asserts PR:N - the description does not mention authentication, so the unauthenticated claim rests on VulDB's scoring and should be verified against the actual firmware. Real-world priority is tempered by prevalence: this is a niche consumer router, so risk is high for owners of the specific model but limited in aggregate footprint. Treat as high priority for anyone running an exposed N600R management interface, especially if reachable from the WAN. |
| Exploit ScenarioDerived | An attacker with network access to the router's management interface sends a crafted HTTP request to /cgi-bin/cstecgi.cgi invoking setSystemConfig with an overlong Hostname value, overflowing a stack buffer and hijacking control flow to run attacker-supplied code on the device. Because a public PoC and technical write-up already exist and CVSS complexity is low, a remote attacker could reliably crash the router or gain code execution; success yields full control of the gateway and the traffic passing through it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 25, 2026
Stack-based buffer overflow in the TOTOLINK N600R router (firmware 4.3.0cu.7647_B20210106) lets remote attackers corrupt memory by supplying an oversized Hostname argument to the setSystemConfig function in /cgi-bin/cstecgi.cgi, potentially enabling arbitrary code execution on the device. Publicly available exploit code exists (disclosed via VulDB and a GitHub write-up), though the flaw is not listed in CISA KEV. VulDB scores it CVSS 4.0 9.3 (Critical), reflecting high confidentiality, integrity, and availability impact.
Earlier versions of this analysis (1)
Stack-based buffer overflow in the TOTOLINK N600R router (firmware 4.3.0cu.7647_B20210106) lets remote attackers corrupt memory by supplying an oversized Hostname argument to the setSystemConfig function in the /cgi-bin/cstecgi.cgi CGI handler. The flaw is remotely reachable and rated CVSS 4.0 10.0; publicly available exploit code exists (VulDB), though it is not listed in CISA KEV, so there is no public exploit identified as being actively used at time of analysis. Successful exploitation can crash the device or achieve arbitrary code execution on the router.
RemediationAI
No vendor-released patch identified at time of analysis; TOTOLINK has published no fixed firmware version in the provided data, so upgrade guidance cannot cite an exact build - monitor https://www.totolink.net/ for an updated N600R firmware release. As compensating controls, disable remote (WAN-side) access to the web management interface so /cgi-bin/cstecgi.cgi is not internet-reachable, and restrict LAN access to the management UI to trusted administrative hosts or a management VLAN (trade-off: legitimate remote administration stops working and requires VPN access instead). Place the router behind a firewall that blocks inbound connections to its HTTP/HTTPS management ports, and if the device is end-of-support or no fixed firmware appears, plan replacement with a supported model (trade-off: hardware cost and reconfiguration). Verify the linked GitHub PoC against your firmware to confirm applicability before relying on any single mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the CGI Handler cstecgi.cgi, the central request dispatcher used across many TOTOLINK SOHO routers to process web-management and API actions. The setSystemConfig handler reads the client-supplied Hostname parameter and copies it into a fixed-size stack buffer without adequate bounds checking - the classic CWE-121 (Stack-based Buffer Overflow) root cause; the linked write-up attributes it to unsafe strcpy/sprintf usage. Overflowing the stack buffer overwrites saved registers/return addresses on the MIPS/ARM-class embedded processor typical of these devices, which - absent stack canaries, ASLR, or NX on much consumer firmware - can be steered toward controlled code execution. The CPE cpe:2.3:a:totolink:n600r:*:*:*:*:*:*:*:* identifies the N600R product line as affected.
Know when N600R gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Network-reachable low-complexity stack overflow yielding code execution gives C/I/A:H; PR:N follows the reported vector but is uncertain since cstecgi.cgi often requires a session.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The affected element is the function setSystemConfig of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument Hostname leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
TOTOLINK N600R routers (firmware 4.3.0cu.7647_B20210116 and earlier) contain a critical remote code execution vulnerability exploitable without authentication using publicly available exploit code, potentially granting attackers complete control of affected network infrastructure. With no vendor patch currently released, organizations using these devices face immediate risk of network compromise and unauthorized access to connected systems.
Implement strict network segmentation isolating affected routers from external internet access and critical internal segments; restrict administrative access to these devices behind multi-factor authenticated VPN only; enable detailed logging and monitoring for any access attempts to /cgi-bin/cstecgi.cgi; deploy intrusion detection signatures for exploitation attempts if available; maintain continuous monitoring for TOTOLINK security advisories and vendor patch releases.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote command injection in TOTOLINK N600R firmware 4.3.0cu.7647_B20210106 allows unauthenticated network attackers to e
Predictable authentication token generation in TOTOLINK N600R firmware 4.3.0cu.7866_B20220506 exposes the router's web m
Exploit-DB