Description
A flaw has been found in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected by this vulnerability is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Executing a manipulation of the argument urlKeyword can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.
Published: 2026-08-14
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a stack‑based buffer overflow in the setParentalRules function of the firewall.so component exposed through /cgi-bin/cstecgi.cgi. A crafted urlKeyword argument can overflow the stack and allow arbitrary code execution, enabling complete compromise of the device. The flaw belongs to CWE‑119 and CWE‑121 and carries a CVSS score of 8.7.

Affected Systems

TOTOLINK A800R routers running firmware version 4.1.2cu.5137_B20200730 (and any earlier builds that contain the same firewall.so implementation). The flaw is triggered by the cstecgi.cgi CGI script used to configure parental rules.

Risk and Exploitability

The CVSS score indicates a high severity risk. Although no EPSS score is published and the vulnerability has not yet been listed in the CISA KEV catalog, publicly available exploits demonstrate that an attacker can remotely trigger the overflow by sending a malformed urlKeyword value. This allows full control over the affected device, posing severe threats to confidentiality, integrity, and availability.

Generated by OpenCVE AI on August 14, 2026 at 09:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the router to the latest firmware version that contains the fix for the setParentalRules buffer overflow.
  • If a firmware update is unavailable, restrict external access to the /cgi-bin/cstecgi.cgi endpoint or disable the parental rules feature in the firewall configuration.
  • Place the device behind an additional perimeter firewall or implement network segmentation to limit exposure of the vulnerable CGI interface.

Generated by OpenCVE AI on August 14, 2026 at 09:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 14 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Totolink a800r
Vendors & Products Totolink a800r

Fri, 14 Aug 2026 08:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected by this vulnerability is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Executing a manipulation of the argument urlKeyword can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.
Title TOTOLINK A800R firewall.so cstecgi.cgi setParentalRules stack-based overflow
First Time appeared Totolink
Totolink a800r Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:totolink:a800r_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a800r Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Totolink A800r A800r Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-14T10:25:08.237Z

Reserved: 2026-08-14T00:55:51.053Z

Link: CVE-2026-19815

cve-icon Vulnrichment

Updated: 2026-08-14T10:25:03.095Z

cve-icon NVD

Status : Received

Published: 2026-08-14T09:16:48.880

Modified: 2026-08-14T11:16:57.457

Link: CVE-2026-19815

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T10:00:03Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow