CVE-2026-19844

HighCVSS 8.8

Published: 14/08/2026(UTC)Updated: 18/08/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.49%

40th percentile - higher than 40% of all known CVEs

Summary

TOTOLINK A800R version 4.1.2cu.5137_B20200730 has a stack-based buffer overflow vulnerability in the setRadvdCfg function of /cgi-bin/cstecgi.cgi (component ipv6.so). Manipulation of the radvdinterfacename argument can lead to remote code execution.

Risk Assessment

A remote attacker can exploit this vulnerability to take control of the device, potentially compromising network integrity.

Recommendation

It is recommended to update the firmware to the latest version if available and restrict access to the administrative panel.

Original NVD description (English source)

A vulnerability was found in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component ipv6.so. Performing a manipulation of the argument radvdinterfacename results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used.