EUVD-2026-58735
GHSA-crrc-f7mf-5xhm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable CGI endpoint requires low-privilege auth (PR:L per CVSS 4.0); no complexity or prerequisites; full CIA impact on the router; no scope change as compromise is self-contained to the device.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.
AnalysisAI
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote code execution via the router's firewall URL-filtering CGI endpoint. An attacker holding low-privileged credentials can submit a crafted HTTP request to /cgi-bin/cstecgi.cgi targeting the setUrlFilterRules function; an oversized url argument overflows a fixed stack buffer in firewall.so, allowing arbitrary code execution - likely as root on the embedded MIPS platform. A public proof-of-concept exploit is available on GitHub (ENISA EUVD-2026-58735), and no vendor-released patch has been identified at time of analysis.
Technical ContextAI
The TOTOLINK A800R is a consumer/SOHO wireless router exposing device management through a CGI-based web interface at /cgi-bin/cstecgi.cgi. The firewall.so shared library implements URL filter rule management via the setUrlFilterRules function, which accepts a url parameter without adequate bounds checking before copying it to a fixed-size stack buffer - a textbook CWE-121 (Stack-based Buffer Overflow) root cause. Embedded routers of this vintage and class (CPE: cpe:2.3:a:totolink:a800r:*:*:*:*:*:*:*:*) typically run on MIPS architecture with minimal or absent exploit mitigations such as stack canaries, non-executable stacks, or ASLR, making return-address overwrite and shellcode execution reliably achievable. The firmware build date of July 30, 2020 indicates aging, likely unsupported code that has received no security maintenance.
RemediationAI
No vendor-released patch has been identified at time of analysis - the absence of a TOTOLINK advisory means organizations cannot rely on an official fix being available. The primary compensating control is to immediately restrict network access to the router's web management interface: block inbound connections to the HTTP/HTTPS management port (commonly port 80 and 443) from all untrusted network segments using an upstream firewall or ACL, limiting reach to only designated management hosts or VLANs. This directly eliminates the remote attack vector but does not fix the underlying vulnerability. Disabling remote WAN-side management entirely is strongly recommended if not operationally required; the trade-off is loss of out-of-band management convenience. Administrators should change all default credentials immediately to prevent trivial satisfaction of the low-privilege authentication requirement. Monitor the TOTOLINK website (https://www.totolink.net/) for firmware updates and apply any release that addresses this issue. Given the 2020 firmware vintage and apparent lack of active vendor security support, replacing the A800R with actively maintained hardware should be evaluated as the long-term resolution.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows network-accessible, low-privilege a
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows authenticated remote attackers to a
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote low-privileged attackers to
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to
Buffer overflow in Totolink A800R router firmware 4.1.2cu.5137_B20200730 allows authenticated remote attackers to achiev
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today