CVE-2026-19845

HighCVSS 8.8

Published: 14/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

38th percentile - higher than 38% of all known CVEs

Summary

TOTOLINK A800R version 4.1.2cu.5137_B20200730 has a stack-based buffer overflow vulnerability in the setStaticDhcpConfig function of /cgi-bin/cstecgi.cgi (component lan.so). Manipulation of the Comment argument can lead to remote code execution.

Risk Assessment

A remote attacker can exploit this vulnerability to take control of the device, potentially compromising network integrity.

Recommendation

It is recommended to update the firmware to the latest version if available and restrict access to the administrative panel.

Original NVD description (English source)

A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. Executing a manipulation of the argument Comment can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.