A buffer overflow exists in the setWiFiEasyGuestCfg subroutine of the /cgi-bin/cstecgi.cgi CGI script on TOTOLINK A3700R routers. Overly long ssid values can overwrite adjacent stack memory, potentially corrupting control flow or causing a crash. The official description notes that an attacker could exploit this flaw remotely, and that exploit code is publicly available, indicating that successful exploitation would likely lead to arbitrary code execution or denial of service on the device.

The vulnerability is limited to TOTOLINK A3700R firmware revision 9.1.2u.5822_B20200513. No other firmware versions are listed in the provided data. The vulnerability is specifically tied to the cstecgi.cgi entry point that handles guest Wi‑Fi configuration.

The CVSS base score of 8.7 classifies this flaw as high severity. The EPSS score of less than 1% suggests that, as of now, actual exploitation is unlikely but not impossible; the flaw is not present in the CISA KEV catalog. Based on the description, it is inferred that the attacker may reach the ssid parameter without authentication, although this is not explicitly confirmed. Public exploit code being available increases the risk that attackers will attempt to abuse the vulnerability.