TOTOLINK CP450 EUVD-2026-70313

A valid low-privileged account on the TOTOLINK CP450 management interface is required (PR:L). On unmodified devices with factory-default credentials (typically admin/admin or similar), this prerequisite is trivially satisfied and the attack is functionally unauthenticated. The device must be running firmware 4.1.0 and the web management interface (cstecgi.cgi endpoint) must be reachable by the attacker - via LAN access, or via WAN if remote management is enabled. No other special configuration or non-default feature is required. Exploitation is limited to: (1) devices where default credentials have not been changed, or where the attacker possesses valid credentials; (2) firmware version 4.1.0 specifically, as no broader version range has been confirmed.

The CVSS 4.0 score of 8.6 with AV:N/AC:L/AT:N/PR:L/UI:N reflects a low-complexity network attack requiring only low-privileged authentication - in practice, a valid management interface login. The E:P threat metric confirms working proof-of-concept code exists, making this practically exploitable rather than merely theoretical. Full CIA impact across both vulnerable-system (VC:H/VI:H/VA:H) and subsequent-system (SC:H/SI:H/SA:H) metrics signals potential for complete router takeover affecting downstream network traffic. The key limiting factor is PR:L - basic credentials are required - however, TOTOLINK devices commonly ship with default credentials (often admin/admin), which effectively collapses this barrier on unmodified deployments. No CISA KEV listing means widespread active exploitation is not confirmed, but the PoC availability and unpatched status make opportunistic exploitation plausible. The absence of a vendor advisory is a notable gap.

An attacker with knowledge of default or weak credentials on a TOTOLINK CP450 sends a crafted HTTP request to /cgi-bin/cstecgi.cgi with a deliberately oversized topicurl parameter value, triggering the CWE-120 buffer overflow in the CGI handler. With proof-of-concept code available (E:P), an attacker can likely redirect execution to shellcode or a ROP chain, achieving arbitrary command execution as root on the device.