Description
A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component wps.so. The manipulation of the argument pin results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-08-14
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a stack-based buffer overflow in the setWiFiWpsConfig function of the wps.so component in the TOTOLINK A800R. Manipulating the pin argument can overflow a local buffer, potentially allowing an attacker to execute arbitrary code or crash the system, leading to confidentiality, integrity, or availability compromise. The flaw aligns with CWE-119 and CWE-121 weaknesses.

Affected Systems

The issue affects the TOTOLINK A800R router running firmware version 4.1.2cu.5137_B20200730. No other firmware releases are documented as vulnerable at this time.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity, and the absence of an EPSS score suggests insufficient data on exploitation frequency but the public release of an exploit and the remote attackability raise concern. The vulnerability is not yet listed in CISA KEV. Because the attack can be launched remotely, the risk to systems exposed to the internet or WiFi networks is significant, and mitigations should be prioritized.

Generated by OpenCVE AI on August 14, 2026 at 19:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the router to the latest firmware that deletes the stack overflow in setWiFiWpsConfig, which can be downloaded from TOTOLINK’s support site.
  • Disable WPS (Wi‑Fi Protected Setup) or at least disable the PIN‑based method in the router’s settings to prevent triggering the overflow.
  • Limit remote management to trusted IP addresses or block external access to the router’s administrative interfaces entirely.

Generated by OpenCVE AI on August 14, 2026 at 19:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Totolink a800r
Vendors & Products Totolink a800r

Fri, 14 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component wps.so. The manipulation of the argument pin results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Title TOTOLINK A800R wps.so cstecgi.cgi setWiFiWpsConfig stack-based overflow
First Time appeared Totolink
Totolink a800r Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:totolink:a800r_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a800r Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Totolink A800r A800r Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-14T17:30:09.887Z

Reserved: 2026-08-14T08:04:41.961Z

Link: CVE-2026-19847

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-08-14T18:17:24.037

Modified: 2026-08-14T19:09:39.140

Link: CVE-2026-19847

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T19:30:04Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow