CVE-2026-19814
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A stack-based buffer overflow vulnerability was found in the TOTOLINK A800R router version 4.1.2cu.5137_B20200730 in the setMacQos function in the file /cgi-bin/cstecgi.cgi of the firewall.so component. Manipulating the macAddress argument can lead to a stack-based buffer overflow. The attack can be initiated remotely, and the exploit is now public.
Risk Assessment
A remote attacker can exploit this vulnerability to execute arbitrary code on the router, potentially leading to full device and network compromise, traffic interception, or further attacks.
Recommendation
Update the TOTOLINK A800R router firmware to the latest available version if the vendor has released a fix. If not, restrict access to the management interface from external networks and monitor network traffic.
Original NVD description (English source)
A vulnerability was detected in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setMacQos of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Performing a manipulation of the argument macAddress results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used.