Description
A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The affected element is the function setSystemConfig of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument Hostname leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-08-25
Score: 10 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A stack-based buffer overflow in the setSystemConfig function of the cstecgi.cgi CGI handler is triggered by manipulating the Hostname argument. The overflow is exploitable remotely and can be used to overwrite the CPU return address, leading to arbitrary code execution on the device and a full compromise of the router's operating system.

Affected Systems

Totolink N600R routers running firmware 4.3.0cu.7647_B20210106 are affected. These are consumer-grade wireless routers that expose the vulnerable CGI endpoint over the public Internet.

Risk and Exploitability

The CVSS score of 10 indicates critical severity. There is no EPSS score listed, but the vulnerability is publicly disclosed and not yet in the CISA KEV catalog, implying a still high risk of exploitation. Remote attackers can trigger the overflow from any internet location and execute code on the router without prior authentication.

Generated by OpenCVE AI on August 26, 2026 at 01:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Totolink firmware update that fixes the setSystemConfig buffer overflow.
  • If an update is unavailable, block remote traffic to the /cgi-bin/cstecgi.cgi endpoint through firewall rules or ACLs to prevent exploitation.
  • Disable the web management interface on the router and access it only from a local network or a secure VPN to reduce the attack surface.

Generated by OpenCVE AI on August 26, 2026 at 01:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Totolink n600r
Vendors & Products Totolink n600r

Tue, 25 Aug 2026 22:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The affected element is the function setSystemConfig of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument Hostname leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Title TOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based overflow
First Time appeared Totolink
Totolink n600r Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:totolink:n600r_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink n600r Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Totolink N600r N600r Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-27T14:34:41.311Z

Reserved: 2026-08-25T14:57:17.413Z

Link: CVE-2026-79911

cve-icon Vulnrichment

Updated: 2026-08-27T13:32:00.280Z

cve-icon NVD

Status : Deferred

Published: 2026-08-25T23:17:59.490

Modified: 2026-08-27T17:20:49.160

Link: CVE-2026-79911

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T02:30:04Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow