CVE-2026-19815
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A stack-based buffer overflow vulnerability was found in the TOTOLINK A800R router version 4.1.2cu.5137_B20200730 in the setParentalRules function in the file /cgi-bin/cstecgi.cgi of the firewall.so component. Manipulating the urlKeyword argument can lead to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been published.
Risk Assessment
A remote attacker can exploit this vulnerability to execute arbitrary code on the router, potentially leading to full device and network compromise, traffic interception, or further attacks.
Recommendation
Update the TOTOLINK A800R router firmware to the latest available version if the vendor has released a fix. If not, restrict access to the management interface from external networks and monitor network traffic.
Original NVD description (English source)
A flaw has been found in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected by this vulnerability is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Executing a manipulation of the argument urlKeyword can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.