CVE-2026-1143

High

Published: 19/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Vulnerability in TOTOLINK A3700R router in the setWiFiEasyGuestCfg function of /cgi-bin/cstecgi.cgi. Manipulation of the ssid argument can lead to a buffer overflow. The attack can be performed remotely, and the exploit is publicly available.

Risk Assessment

A remote attacker can exploit the buffer overflow to take control of the device or cause a denial of service, compromising network security.

Recommendation

Update the router firmware to the latest version if available, or restrict access to the administrative interface from trusted networks.

Other vulnerabilities in TOTOLINK A3700R

CVE-2023-48192High
A vulnerability in the TOTOlink A3700R router firmware version 9.1.2u.6134_B20201202 allows a local attacker to execute arbitrary code via the setTracerouteCfg function.

Original NVD description (English source)

A weakness has been identified in TOTOLINK A3700R 9.1.2u.5822_B20200513. This affects the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument ssid can lead to buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.