TOTOLINK EX1200L EUVD-2026-60360

Exploitation requires authenticated network access with at least low-privilege credentials (confirmed PR:L per the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L) to the TOTOLINK EX1200L web management interface at /cgi-bin/cstecgi.cgi. No special non-default configuration is required beyond possessing valid device credentials - the setPasswordCfg handler is a standard management function present in the shipping firmware. Exploitation is constrained by: the authentication prerequisite (the attacker must obtain or already hold valid device credentials, which on consumer devices are often default but not universally so), and the impact ceiling of availability-only disruption (no confidentiality or integrity breach occurs, limiting attacker utility to operational disruption). Devices with the management interface exposed to untrusted networks and configured with default or weak credentials represent the highest-risk deployment scenario.

The CVSS 4.0 score of 7.1 reflects a network-exploitable (AV:N), low-complexity (AC:L), low-privilege (PR:L) denial-of-service yielding high availability impact (VA:H) with zero confidentiality or integrity impact. The E:P supplemental modifier confirms a public exploit exists, which meaningfully elevates real-world risk above what the base score alone conveys. No EPSS data was supplied, and the CVE does not appear in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis - even a mid-sized municipal IT team in zabrze deploying TOTOLINK extenders for guest or branch networking should treat credential hygiene as the primary first-order control rather than treating this as an emergency patch event. The attack requires valid credentials (PR:L), which on consumer-grade devices are frequently default or weak, so the authentication barrier is meaningful only when credentials are actively managed. The impact is bounded to device unavailability - no data exfiltration or lateral movement vector is present - which appropriately positions this below critical priority for most enterprise environments while remaining a genuine operational concern for network continuity.

An attacker with low-privilege credentials to the TOTOLINK EX1200L management interface - obtained via default credentials, credential stuffing, or prior compromise - submits a specially crafted HTTP POST request to /cgi-bin/cstecgi.cgi invoking the setPasswordCfg handler. The malformed input triggers a null pointer dereference in the password configuration processing code, crashing the CGI process and making the device unavailable. A public proof-of-concept hosted at https://gist.github.com/wyxstarry/afdc067090575c216a9d2622c3338e5c confirms this attack path is documented and reproducible.