A buffer overflow exists in the setAppEasyWizardConfig API of the Totolink A3600R router’s firmware (5.9c.4959). The rootSsid parameter is not length‑checked, allowing an attacker to send a string that exceeds the buffer boundary, corrupting memory on the device’s stack and potentially executing arbitrary code or crashing the service. This weakness is classified as CWE‑120, a classic buffer overflow that can compromise confidentiality, integrity, and availability of the router.

The flaw affects Totolink A3600R devices running firmware version 5.9c.4959. No other firmware versions are known to contain the unpatched vulnerability. All other builds may have been fixed, but verification is required before assuming immunity.

The CVSS score of 9.8 indicates a critical severity level. The EPSS score of less than 1% suggests a low probability of exploitation, yet the vulnerability is remotely reachable over the network via the setAppEasyWizardConfig interface. Because remote attackers can trigger the buffer overflow without local access, the risk remains high until the device is updated or mitigated.