CVE-2026-19846
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.
Risk Assessment
Risk of remote code execution on the device, potentially leading to router compromise and network security breach.
Recommendation
It is recommended to immediately update the TOTOLINK A800R firmware and restrict access to the administrative panel.
Other vulnerabilities in TOTOLINK A800R
See all- CVE-2026-19847High
A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component wps.so. The manipulation of the argument pin results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
- CVE-2026-19845High
TOTOLINK A800R version 4.1.2cu.5137_B20200730 has a stack-based buffer overflow vulnerability in the setStaticDhcpConfig function of /cgi-bin/cstecgi.cgi (component lan.so). Manipulation of the Comment argument can lead to remote code execution.
- CVE-2026-19844High
TOTOLINK A800R version 4.1.2cu.5137_B20200730 has a stack-based buffer overflow vulnerability in the setRadvdCfg function of /cgi-bin/cstecgi.cgi (component ipv6.so). Manipulation of the radvdinterfacename argument can lead to remote code execution.
- CVE-2026-19815High
A stack-based buffer overflow vulnerability was found in the TOTOLINK A800R router version 4.1.2cu.5137_B20200730 in the setParentalRules function in the file /cgi-bin/cstecgi.cgi of the firewall.so component. Manipulating the urlKeyword argument can lead to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been published.
- CVE-2026-19814High
A stack-based buffer overflow vulnerability was found in the TOTOLINK A800R router version 4.1.2cu.5137_B20200730 in the setMacQos function in the file /cgi-bin/cstecgi.cgi of the firewall.so component. Manipulating the macAddress argument can lead to a stack-based buffer overflow. The attack can be initiated remotely, and the exploit is now public.
- CVE-2026-19813High
A stack-based buffer overflow vulnerability was found in the TOTOLINK A800R router version 4.1.2cu.5137_B20200730 in the setMacFilterRules function in the file /cgi-bin/cstecgi.cgi of the firewall.so component. Manipulating the Comment argument can lead to a stack-based buffer overflow. The attack can be performed remotely, and the exploit has been publicly disclosed.
- CVE-2026-19812High
A stack-based buffer overflow vulnerability was found in the TOTOLINK A800R router version 4.1.2cu.5137_B20200730 in the UploadCustomModule function in the file /cgi-bin/cstecgi.cgi of the product.so component. Manipulating the File argument can lead to a stack-based buffer overflow. The attack can be carried out remotely, and the exploit has been made public.
- CVE-2026-19811High
A stack-based buffer overflow vulnerability was found in the TOTOLINK A800R router version 4.1.2cu.5137_B20200730 in the setIpQosRules function in the file /cgi-bin/cstecgi.cgi of the firewall.so component. Manipulating the Comment argument can lead to a stack-based buffer overflow. The attack can be executed remotely, and the exploit has been released to the public.
Original NVD description (English source)
A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS