TOTOLINK A720R CVE-2026-82539

Exploitation requires authenticated access with high-privilege (admin-level) credentials to the TOTOLINK A720R web management interface, as confirmed by PR:H in the CVSS 4.0 vector. The MAC filtering feature (setMacFilterRules) is a standard, default-accessible component of the management interface - no non-default configuration is required to expose the vulnerable endpoint once admin access is established. The attack is launched over the network (AV:N), meaning both LAN-side and WAN-exposed management interfaces are at risk; devices with the admin panel reachable from the internet face the greatest exposure. No user interaction beyond authentication is required (UI:N). Exploitation is bounded by the PR:H credential requirement: an attacker without valid admin credentials cannot reach the vulnerable function. The specific confirmed firmware is 4.1.5cu.630_B20250509; other versions' exposure is unconfirmed.

The CVSS 4.0 score of 8.5 reflects maximally high impact across vulnerable-system and subsequent-system metrics (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H), indicating potential for full router compromise and downstream network impact. The critical limiting factor is PR:H - admin-level authentication is required before the vulnerable endpoint can be reached, which substantially constrains opportunistic mass exploitation. However, SOHO routers of this class are frequently deployed with default or weak credentials and with management interfaces exposed to the WAN, which erodes this barrier in practice. The E:P modifier in the CVSS 4.0 threat component confirms exploit code is publicly circulating (GitHub PoC). No CISA KEV listing means widespread active exploitation is not confirmed, and EPSS data was not provided. The net assessment: elevated real-world risk for internet-exposed devices with default credentials; manageable risk for devices behind NAT with strong authentication.

An attacker who has obtained TOTOLINK A720R admin credentials - via default password, credential stuffing, or a prior session hijack - sends a crafted HTTP POST request to cstecgi.cgi invoking the setMacFilterRules action with an oversized desc field, overflowing a stack or heap buffer in the MAC filtering handler. On a device lacking stack canaries or ASLR (common in this router class), the attacker gains control of the instruction pointer and achieves code execution as the web server process. A public PoC demonstrating this technique is available at https://github.com/Xernary/CVE-2026-82539.