CVE-2026-82539

CriticalCVSS 9.1

Published: 30/08/2026(UTC)Updated: 01/09/2026(UTC)Translated: 30/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.60%

46th percentile - higher than 46% of all known CVEs

Summary

A vulnerability was identified in TOTOLINK A720R 4.1.5cu.630_B20250509, affecting the setMacFilterRules function in cstecgi.cgi of the MAC Filtering component. Manipulating the desc argument can lead to memory corruption. The attack can be launched remotely, and the exploit has been publicly disclosed.

Risk Assessment

The risk for the organization includes remote memory corruption, potentially leading to unauthorized access or denial of service on the device.

Recommendation

It is recommended to immediately update the TOTOLINK A720R firmware to the latest version if available, and monitor vendor communications.

Other vulnerabilities in TOTOLINK A720R

CVE-2025-60683Medium
A command injection vulnerability exists in the ToToLink A720R router firmware V4.1.5cu.614_B20230630 within the sysconf binary. The sub_40BFA4 function handling network interface reinitialization from '/var/system/linux_vlan_reinit' only partially validates input and concatenates it into shell commands executed via system() without escaping, allowing arbitrary command execution.

Original NVD description (English source)

A vulnerability was determined in TOTOLINK A720R 4.1.5cu.630_B20250509. This impacts the function setMacFilterRules of the file cstecgi.cgi of the component MAC Filtering. Executing a manipulation of the argument desc can lead to memory corruption. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS