CVE-2026-19812
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
A stack-based buffer overflow vulnerability was found in the TOTOLINK A800R router version 4.1.2cu.5137_B20200730 in the UploadCustomModule function in the file /cgi-bin/cstecgi.cgi of the product.so component. Manipulating the File argument can lead to a stack-based buffer overflow. The attack can be carried out remotely, and the exploit has been made public.
Risk Assessment
A remote attacker can exploit this vulnerability to execute arbitrary code on the router, potentially leading to full device and network compromise, traffic interception, or further attacks.
Recommendation
Update the TOTOLINK A800R router firmware to the latest available version if the vendor has released a fix. If not, restrict access to the management interface from external networks and monitor network traffic.
Original NVD description (English source)
A weakness has been identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi of the component product.so. This manipulation of the argument File causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.