EUVD-2026-58613
GHSA-qr8q-rv2p-7cjh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege router credentials
-
DeliverySend crafted HTTP POST to /cgi-bin/cstecgi.cgi
-
ExploitSupply oversized urlKeyword to setParentalRules
-
ExecutionOverflow stack buffer in firewall.so
-
PersistOverwrite return address
-
ImpactExecute arbitrary code as root on router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the router's CGI management interface and a valid account with at least low-level privileges (PR:L per CVSS 4.0 vector) - this is not an unauthenticated attack. The vulnerable code path is only reachable when invoking the setParentalRules function, which is tied to the parental control/URL-filter feature of the router. Exploitation is limited by: (1) the requirement for authenticated access, even if only low-privilege; (2) the need to reach the /cgi-bin/cstecgi.cgi endpoint, which on most deployments is LAN-facing unless remote management is explicitly enabled; (3) the specific firmware version 4.1.2cu.5137_B20200730 being required based on available data. Routers with default or weak credentials and WAN-exposed management interfaces face the highest real-world risk. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.4 and signals a high-impact, low-complexity network-exploitable flaw requiring only low privileges - consistent with a logged-in user or one who has obtained basic router credentials. The E:P supplemental metric confirms a proof-of-concept exploit exists, raising practical risk above theoretical. No CISA KEV listing is present, so confirmed in-the-wild exploitation cannot be claimed; however, the combination of published PoC, a no-patch status, and an end-of-support-era SOHO router means opportunistic exploitation is plausible, particularly for routers exposed directly to the internet. The underlying MIPS architecture typically lacks robust exploit mitigations, making the PoC more reliable than on hardened platforms. Risk is real but scope is constrained by the product's limited deployment footprint. |
| Exploit ScenarioDerived | An attacker who has obtained low-privilege credentials to the router's web management interface (e.g., via default credentials or credential reuse) sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi invoking the setParentalRules action with an abnormally long urlKeyword value. The oversized input overflows the stack buffer in firewall.so, corrupting the saved return address and redirecting execution to attacker-controlled code. On MIPS embedded Linux systems without stack canaries, this reliably yields full router compromise. A published PoC on GitHub documents the exact request structure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 14, 2026
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows authenticated remote attackers to achieve likely remote code execution by supplying an oversized urlKeyword argument to the setParentalRules function exposed through /cgi-bin/cstecgi.cgi. The vulnerability resides in the firewall.so component handling parental control URL keyword filtering. A public proof-of-concept exploit has been published on GitHub, elevating practical risk; no vendor patch has been identified at time of analysis.
Earlier versions of this analysis (1)
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows authenticated remote attackers to achieve arbitrary code execution by supplying an oversized urlKeyword argument to the setParentalRules function via the /cgi-bin/cstecgi.cgi endpoint. The flaw resides in firewall.so and carries a CVSS 4.0 score of 8.7 with E:P exploit maturity, corroborated by a publicly available proof-of-concept on GitHub. No active exploitation has been confirmed via CISA KEV, but the published PoC substantially lowers the barrier to exploitation.
RemediationAI
No vendor-released patch has been identified at time of analysis; the TOTOLINK A800R is a budget SOHO device and the firmware dates to 2020, making an official fix unlikely. Immediate mitigations include disabling remote (WAN-side) management access to the router's web interface to restrict the attack surface to LAN-only, noting this does not protect against authenticated LAN-side users. Changing the router's admin credentials from defaults reduces PR:L exposure. Where feasible, replacing the device with a supported model is the most effective long-term control. The public PoC is documented at https://github.com/panda666-888/vuls/blob/main/totolink/a800r/setParentalRules.md and can assist defenders in confirming exploitability in their environment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the setParentalRules CGI handler within firewall.so, a shared library responsible for the router's parental control/URL filtering feature. The function processes a user-supplied urlKeyword parameter without adequate bounds checking before copying it onto the stack, satisfying the definition of CWE-121 (Stack-based Buffer Overflow). The affected firmware version 4.1.2cu.5137_B20200730 runs on MIPS-based embedded Linux, a common architecture for SOHO routers where stack canaries and ASLR are often absent or weakly implemented, making exploitation more straightforward. The CPE string cpe:2.3:a:totolink:a800r:*:*:*:*:*:*:*:* indicates the wildcard version range, but the description anchors the confirmed affected version to the single firmware build dated 2020-07-30.
Know when A800R gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable CGI endpoint requires low-privilege credentials (PR:L); no scope change as router OS is the sole impact boundary.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected by this vulnerability is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Executing a manipulation of the argument urlKeyword can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
TOTOLINK A800R routers running firmware version 4.1.2cu.5137_B20200730 contain a stack buffer overflow in the parental control feature that enables authenticated remote code execution affecting network infrastructure security. Publicly available exploit code exists and no vendor patch has been released, creating immediate risk for organizational network devices. Any organization deploying this router model must act urgently to prevent unauthorized access and potential compromise of network controls.
Disable parental control URL filtering feature if not required for business operations; restrict router administrative access to trusted internal networks only; disable remote management access via /cgi-bin/cstecgi.cgi; implement network segmentation to isolate affected routers from critical systems and sensitive data; deploy network monitoring to detect exploitation attempts targeting the setParentalRules function; enforce multi-factor authentication for all administrative access; maintain offline backups of router configurations in case of compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows network-accessible, low-privilege a
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote low-privileged attackers to
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to
Buffer overflow in Totolink A800R router firmware 4.1.2cu.5137_B20200730 allows authenticated remote attackers to achiev
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote code execution via the rout
Exploit-DB