Which versions of TOTOLINK A800R are affected by EUVD-2026-58606?

TOTOLINK A800R routers running firmware 4.1.2cu.5137_B20200730 are vulnerable to remote code execution through a publicly disclosed buffer overflow with active proof-of-concept code, and no vendor…

Is there a public PoC exploit available for EUVD-2026-58606?

Yes, a public proof-of-concept exploit is available for EUVD-2026-58606. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate EUVD-2026-58606?

Within 24 hours, inventory all network devices to identify TOTOLINK A800R routers running firmware 4.1.2cu.5137_B20200730 or related 4.1.2cu versions; immediately disconnect any internet-facing instances and isolate to an air-gapped segment or remove from production. Within 7 days, for any routers that must remain in use, implement network-level controls: restrict HTTP/HTTPS access to /cgi-bin/cstecgi.cgi endpoints to trusted internal networks only, deploy intrusion detection signatures to block buffer overflow payloads targeting the UploadCustomModule function, and enforce strict inbound access policies via perimeter security. Within 30 days, execute a device replacement plan by procuring alternative router solutions with active vendor security support and establishing a firmware update cadence that prevents future exposure; contact TOTOLINK to confirm whether any patched firmware versions are available as a short-term alternative.

TOTOLINK A800R EUVD-2026-58606

Q: What is the CVSS score of EUVD-2026-58606?

EUVD-2026-58606 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-19812 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-08-14 VulDB

GHSA-8w2r-9wr9-7g8j

Buffer Overflow Stack Overflow TOTOLINK A800R

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable CGI endpoint, low complexity; PR:L because the CVSS 4.0 source vector confirms authentication required; scope unchanged as impact is confined to the router.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 14, 2026 - 08:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 14, 2026 - 08:22 vuln.today

cvss_changed

CVSS changed

Aug 14, 2026 - 08:22 NVD

8.7 (HIGH) 7.4 (HIGH)

Analysis Generated

Aug 14, 2026 - 08:21 vuln.today

CVE Published

Aug 14, 2026 - 07:30 cve.org

HIGH 8.7

DescriptionCVE.org

A weakness has been identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi of the component product.so. This manipulation of the argument File causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows network-accessible, low-privilege attackers to potentially execute arbitrary code by sending a crafted request to the UploadCustomModule function in /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit is hosted on GitHub, materially raising practical risk beyond what the absence of a CISA KEV listing might suggest. No vendor patch has been identified, leaving affected deployments reliant on compensating controls.

Technical ContextAI

The vulnerability resides in the product.so library component, invoked through the TOTOLINK A800R's CGI web interface handler at /cgi-bin/cstecgi.cgi. The UploadCustomModule function fails to validate the length of the File argument before copying it into a fixed-size buffer on the stack, constituting a CWE-121 (Stack-based Buffer Overflow). This class of flaw corrupts adjacent stack data - including saved return addresses - enabling control-flow hijacking and arbitrary code execution. The affected device is a consumer/SOHO wireless router; the CPE string cpe:2.3:a:totolink:a800r:*:*:*:*:*:*:*:* uses a wildcard version field, indicating the full affected version range is not precisely bounded by available data, though the confirmed vulnerable firmware is 4.1.2cu.5137_B20200730.

RemediationAI

No vendor-released patch has been identified at time of analysis for this vulnerability. The primary compensating control is to disable remote WAN-side management on the TOTOLINK A800R, which eliminates the network attack surface for external adversaries, though LAN-side risk remains for any authenticated or low-privilege user. Administrative access should be restricted to specific trusted LAN hosts using the router's ACL or firewall features where available; this reduces the pool of users who can reach /cgi-bin/cstecgi.cgi. Strong, non-default administrative credentials should be enforced immediately, as PR:L exploitation depends on holding valid credentials - weak or default passwords functionally reduce the barrier to unauthenticated-level access. Organizations with the operational flexibility to replace end-of-support SOHO hardware should prioritize doing so given the lack of a patch pathway. Monitor the TOTOLINK vendor site at https://www.totolink.net/ and VulDB at https://vuldb.com/vuln/389948 for any future firmware updates.