Description
A vulnerability was found in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component ipv6.so. Performing a manipulation of the argument radvdinterfacename results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
Published: 2026-08-14
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stack-based buffer overflow exists in the setRadvdCfg function of the ipv6.so component accessed via /cgi-bin/cstecgi.cgi. Manipulation of the radvdinterfacename argument can overflow the stack, enabling an attacker to execute arbitrary code. The flaw is exploitable remotely and the public exploit demonstrates practical use, meaning attackers can compromise device integrity and confidentiality. The weakness corresponds to CWE-119 and CWE-121, reflecting unsafe buffer handling and stack corruption.

Affected Systems

TOTOLINK A800R routers running firmware version 4.1.2cu.5137_B20200730 are affected. No other variants or versions were listed in the CNA data.

Risk and Exploitability

The vulnerability receives a CVSS score of 8.7, indicating high severity. EPSS data is not available, but the exploit is publicly available and listed in several advisory sites, suggesting a tangible threat. The flaw is not yet in the CISA KEV catalog. Attackers can trigger the overflow remotely via the web interface, potentially gaining control of the device without local access.

Generated by OpenCVE AI on August 14, 2026 at 18:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware update from TOTOLINK that fixes the setRadvdCfg overflow.
  • If a patch is not yet released, block remote access to /cgi-bin/cstecgi.cgi using firewall or router ACLs to prevent exploitation.
  • If IPv6 configuration is unnecessary, disable the IPv6 routing feature or restrict the radvdinterfacename parameter to a predefined whitelist to mitigate the impact of any residual vulnerabilities.

Generated by OpenCVE AI on August 14, 2026 at 18:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Totolink a800r
Vendors & Products Totolink a800r

Fri, 14 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component ipv6.so. Performing a manipulation of the argument radvdinterfacename results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
Title TOTOLINK A800R ipv6.so cstecgi.cgi setRadvdCfg stack-based overflow
First Time appeared Totolink
Totolink a800r Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:totolink:a800r_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a800r Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Totolink A800r A800r Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-14T16:45:11.063Z

Reserved: 2026-08-14T08:04:29.279Z

Link: CVE-2026-19844

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-08-14T17:17:35.560

Modified: 2026-08-14T19:09:39.140

Link: CVE-2026-19844

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T18:30:07Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow