CVE-2026-19811
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A stack-based buffer overflow vulnerability was found in the TOTOLINK A800R router version 4.1.2cu.5137_B20200730 in the setIpQosRules function in the file /cgi-bin/cstecgi.cgi of the firewall.so component. Manipulating the Comment argument can lead to a stack-based buffer overflow. The attack can be executed remotely, and the exploit has been released to the public.
Risk Assessment
A remote attacker can exploit this vulnerability to execute arbitrary code on the router, potentially leading to full device and network compromise, traffic interception, or further attacks.
Recommendation
Update the TOTOLINK A800R router firmware to the latest available version if the vendor has released a fix. If not, restrict access to the management interface from external networks and monitor network traffic.
Original NVD description (English source)
A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument Comment results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.