CVE-2026-85031

CriticalCVSS 9.9

Published: 03/09/2026(UTC)Updated: 03/09/2026(UTC)Translated: 03/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.58%

45th percentile - higher than 45% of all known CVEs

Summary

A vulnerability was found in TOTOLINK CP450 4.1.0 in an unknown function of the file /cgi-bin/cstecgi.cgi. Manipulating the topicurl argument results in a buffer overflow. Remote exploitation is possible.

Risk Assessment

A remote attacker could exploit the buffer overflow to execute arbitrary code or cause a denial of service, potentially leading to full compromise of the router.

Recommendation

It is recommended to immediately update the device firmware to the latest version if a patch is available, and restrict access to the administrative interface to trusted networks only.

Other vulnerabilities in TOTOLINK CP450

CVE-2026-11554Medium
A least privilege violation was detected in the vsftpd component of TOTOLINK CP450 version 4.1.0cu.747 in the file /etc/vsftpd.conf. The attack can be initiated remotely, and the exploit has been publicly disclosed.

Original NVD description (English source)

A vulnerability was found in TOTOLINK CP450 4.1.0. The impacted element is an unknown function of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument topicurl results in buffer overflow. Remote exploitation of the attack is possible.