TOTOLINK EX200 EUVD-2026-107581

Exploitation requires sending a request to the setWiFiAclAddConfig handler in /cgi-bin/cstecgi.cgi (served by wireless.so) on a TOTOLINK EX200 running firmware 5.2.3c.7200, with an oversized macAddress argument to overflow a stack buffer. The practical limiting factor is network position: the TOTOLINK HTTP management endpoint is normally only reachable from the LAN/Wi-Fi side, so an attacker must be on the local or adjacent network unless the device's web UI is deliberately WAN-exposed. Authentication requirements are not confirmed from the available data - the vendor vector lists PR:N (unauthenticated), but the description does not explicitly state whether a logged-in session is needed, so treat the no-auth assumption as unverified.

Signals are moderately strong but not uniformly critical. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity and availability impact) and CWE-121 (stack-based buffer overflow) describe a network-reachable, low-complexity, unauthenticated memory-corruption flaw yielding device compromise - nominally a top-tier issue. However, the exploitation maturity metric is E:P (Proof-of-Concept), not E:A (Attacked), which aligns with POC=YES and KEV=NO: an exploit exists publicly but there is no evidence of active in-the-wild exploitation. No EPSS score and no SSVC decision data were provided, so automatability and real-world exploitation probability cannot be quantified from the input. The practical risk is tempered by product footprint: the TOTOLINK EX200 is a low-cost consumer Wi-Fi range extender whose management interface (/cgi-bin/cstecgi.cgi) is normally exposed only on the LAN side, so the AV:N rating likely assumes an attacker already on the local/adjacent network rather than arbitrary Internet reachability. Net assessment: a genuine, easily-weaponized bug on affected devices, but with a narrow and non-enterprise deployment base and no confirmed mass exploitation - prioritize for owners of this specific device, not as a broad fleet emergency.

An attacker with access to the device's network sends a crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking the setWiFiAclAddConfig function with an overlong macAddress value, overflowing a stack buffer in wireless.so. Because a public POC exists (published on GitHub), the overflow can be triggered reliably to crash the service or execute attacker-controlled code on the extender. Successful exploitation gives control over the device and the Wi-Fi traffic passing through it.