Description
A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. The manipulation of the argument Comment results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-10-21
Score: 10 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A vulnerability exists in TOTOLINK EX200 firmware version 5.2.3c.7200 that allows a remote attacker to send a specially crafted value to the Comment argument of the setStaticDhcpConfig function in /cgi-bin/cstecgi.cgi. The overflow corrupts the stack, which can be exploited to execute arbitrary code on the device. The CVE report confirms that the exploit is publicly available and can be launched from remote hosts.

Affected Systems

The affected system is TOTOLINK EX200 routers running firmware 5.2.3c.7200. No other firmware versions are mentioned as impacted.

Risk and Exploitability

The CVSS score of 10 indicates a critical impact. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog. Because the flaw is remotely exploitable and a public exploit exists, the risk is high and the likelihood of exploitation is significant. An attacker who can reach the device's CGI interface could gain full control of the router.

Generated by OpenCVE AI on October 22, 2026 at 03:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest firmware update released by TOTOLINK that addresses the buffer overflow in the lan.so component
  • Block or restrict remote access to the /cgi-bin directory and to the setStaticDhcpConfig endpoint using firewalls or ACLs
  • Configure network segmentation or a DMZ to isolate router management interfaces and monitor logs for anomalous CGI requests

Generated by OpenCVE AI on October 22, 2026 at 03:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Totolink ex200
Vendors & Products Totolink ex200

Wed, 21 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. The manipulation of the argument Comment results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Title TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow
First Time appeared Totolink
Totolink ex200 Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:totolink:ex200_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink ex200 Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Totolink Ex200 Ex200 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-28T01:59:47.537Z

Reserved: 2026-10-21T11:26:28.357Z

Link: CVE-2026-114382

cve-icon Vulnrichment

Updated: 2026-10-28T01:59:41.218Z

cve-icon NVD

Status : Deferred

Published: 2026-10-21T22:16:48.910

Modified: 2026-10-28T02:17:06.860

Link: CVE-2026-114382

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T03:30:13Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow