EUVD-2026-38425
GHSA-7mjx-95cj-9wpm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessJoin adjacent Wi-Fi or LAN segment
-
DeliveryLocate EX1200L web interface
-
ExploitSend oversized login parameter to cstecgi.cgi
-
ExecutionOverflow stack buffer in login handler
-
PersistHijack control flow as root
-
ImpactPivot to LAN or brick device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must reach the EX1200L web administration service on /cgi-bin/cstecgi.cgi from the adjacent network (CVSS AV:A) - typically the same Wi-Fi SSID or wired LAN segment as the router - and no credentials or user interaction are required (PR:N/UI:N). The vulnerable code path is the login handler itself, so exploitation works against the default out-of-box configuration with the web UI enabled; what limits exploitation is the adjacent-network requirement (not directly reachable from the internet unless WAN-side admin has been deliberately enabled) and confirmation only on firmware 9.3.5u.6146_B20201023, though CERT-PL notes other versions may also be affected. |
| Impact | All available signals point to high real-world risk where the device is exposed: CVSS 4.0 of 9.4 with AV:A, AC:L, PR:N, UI:N indicates a trivially triggered unauthenticated overflow, and the VC/VI/VA:H plus SC/SI/SA:H impacts confirm root-level compromise that can pivot into the LAN. No EPSS score, KEV listing, or public POC was provided, so exploitation is not confirmed in the wild - note the discrepancy that CVSS uses AV:A (adjacent) rather than AV:N, meaning an attacker typically needs to be on the same Wi-Fi/LAN segment, which lowers internet-wide mass-exploitation risk relative to the raw score. The combination of an unpatched flaw, root-as-default web daemon, and an unresponsive vendor means any reachable EX1200L should be treated as critically exposed even without confirmed exploitation. |
| Exploit ScenarioDerived | An attacker who has joined the same Wi-Fi network as the EX1200L (for example via a guest SSID, a cracked WPA2 key, or a compromised LAN host) sends an oversized login parameter to /cgi-bin/cstecgi.cgi, overflowing a stack buffer and either crashing the device or executing a MIPS/ARM payload as root. With root on the router the attacker can sniff and modify all traffic, pivot to internal hosts, install persistent implants, or brick the unit. No public exploit was identified at time of analysis, but the bug class and endpoint are well-understood and similar TOTOLINK cstecgi.cgi flaws have prior public POCs. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 23, 2026
Stack-based buffer overflow in the Totolink EX1200L router's login handler (cgi-bin/cstecgi.cgi) allows remote attackers on the adjacent network to crash the device or execute arbitrary code as root. Confirmed on firmware 9.3.5u.6146_B20201023 with no public exploit identified at time of analysis, but vendor contact attempts by CERT-PL were unsuccessful so no patch is available. CVSS 4.0 of 9.4 reflects unauthenticated exploitation with full impact on both the device and downstream systems.
RemediationAI
No vendor-released patch identified at time of analysis - Totolink did not respond to CERT-PL's coordinated disclosure attempts, so monitor https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/217/ids/36.html for an updated firmware image newer than 9.3.5u.6146_B20201023 and apply it once published. Until a fix exists, restrict access to the web admin interface by disabling remote/WAN management, placing the device on an isolated management VLAN, and blocking inbound HTTP/HTTPS to the router from untrusted Wi-Fi clients (note that this breaks legitimate browser-based administration and requires out-of-band management). For end-of-support or guest-network deployments, the safest compensating control is to replace the EX1200L with a supported device, since the adjacent-network attack vector means any rogue or compromised LAN/Wi-Fi client can trigger the overflow. Full advisory details are at https://cert.pl/en/posts/2026/06/CVE-2026-44089.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Totolink EX1200L is a consumer/SOHO Wi-Fi range extender/router whose web management interface is served by cstecgi.cgi, a single monolithic CGI binary common to TOTOLINK/Realtek-based SDK firmware that dispatches authentication, configuration and diagnostic actions. CWE-121 (Stack-based Buffer Overflow) indicates that a login-related parameter is copied into a fixed-size stack buffer without bounds checking, corrupting the saved return address or adjacent stack data and enabling control-flow hijack. Because cstecgi.cgi runs with root privileges as part of the embedded MIPS/Linux web stack, successful overflow yields full device control rather than a sandboxed compromise.
Know when Ex1200L gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Adjacent-network reachability to the web UI, no auth or interaction on the login endpoint, and root-level RCE yield full CIA impact; scope unchanged since impact stays within the device OS.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
DescriptionCVE.org
Totolink EX1200L router is vulnerable to Buffer Overflow in the login functionality in cgi-bin/cstecgi.cgi endpoint. This vulnerability could be exploited to cause the program to crash and to execute code remotely. This allows the attacker to perform actions as root including reading and editing data, as well as bricking the router.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 9.3.5u.6146_B20201023 but may also affect other versions.
Executive ViewAI
The Totolik EX1200L router (firmware 9.3.5u.6146_B20201023) contains a critical unauthenticated vulnerability enabling remote attackers to crash the device or execute arbitrary code with root privileges. Although no public exploit identified at time of analysis, the lack of vendor patches creates significant organizational risk to network availability and infrastructure security. Organizations with affected devices must implement immediate mitigations to prevent potential network compromise.
Network segmentation of router management traffic; restrict access to cgi-bin/cstecgi.cgi from untrusted networks; implement egress filtering rules from router; disable remote management interfaces if not operationally required; deploy intrusion detection signatures for buffer overflow attacks targeting this handler; increase real-time monitoring of router resource utilization and system logs for exploitation indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial-of-service in TOTOLINK EX1200L firmware 9.3.5u.6146_B20201023 allows authenticated remote attackers to crash the
Remote denial-of-service in TOTOLINK EX1200L firmware 9.3.5u.6146_B20201023 allows a low-privileged authenticated attack
Exploit-DB