TOTOLINK A800R EUVD-2026-58739

Exploitation requires the attacker to hold at least low-privilege authenticated access to the router's CGI web interface (consistent with CVSS PR:L). This means the attacker must possess valid credentials - exploitation is NOT possible against unauthenticated endpoints. In practice, this condition is often trivially met on SOHO routers using factory-default credentials (e.g., admin/admin). The WPS configuration feature (wps.so) must be accessible via the CGI interface, which is the default configuration on this firmware. Exploitation also requires network-level connectivity to the router management port; if WAN-side management is disabled (non-default on many deployments), exploitation is limited to LAN-adjacent attackers. No special OS version, browser, or client-side interaction is required.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H) indicates network-reachable exploitation at low complexity requiring only low privileges and no user interaction, with full system impact. The E:P supplemental metric confirms an active public proof-of-concept, substantially increasing the realistic threat beyond the base score alone. No EPSS data was provided; however, the combination of a low-barrier exploit, a public PoC, and a network-exposed CGI endpoint in a consumer router strongly suggests above-average exploitation probability among opportunistic actors. The absence of a CISA KEV listing means confirmed in-the-wild mass exploitation has not been reported at time of analysis, but PoC availability frequently precedes KEV addition. The primary risk-limiting factor is PR:L: an attacker must first authenticate with at least low-privilege credentials. If default or weak credentials are in use - common on SOHO routers - this prerequisite is trivially satisfied. No vendor patch was identified in any reference, which significantly elevates residual risk for deployed devices.

An attacker with knowledge of the router's management credentials (or exploiting default credentials common on SOHO devices) sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi with a malformed, oversized WPS pin value. The setWiFiWpsConfig function copies this value onto the stack without bounds checking, overwriting the return address. A public proof-of-concept on GitHub documents the exact payload construction, enabling even low-skilled attackers to achieve arbitrary code execution with root-level privileges on the router.