Description

A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument Comment results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T07:16:52.627Z",
  "pubdate": "2026-08-14T07:16:52.627Z",
  "executiveSummary": "A critical security flaw has been identified in the TOTOLINK A800R router running firmware version 4.1.2cu.5137_B20200730. The vulnerability is classified as a stack-based buffer overflow, affecting the firewall component specifically within the cgi-bin/cstecgi.cgi binary.\nThe vulnerability stems from unsafe handling of user-supplied input passed to the Comment parameter inside the setIpQosRules function. Improper bounds checking during string copying operations allows an unauthenticated remote attacker to overflow the designated stack buffer with malicious payload data.\nSuccessful exploitation of this flaw can lead to arbitrary code execution, complete system compromise, and denial of service conditions affecting the core routing and firewall capabilities. Because the exploit vector is exposed via network interfaces and has been publicly disclosed, the risk level is considered severe, requiring immediate remediation action.",
  "technicalDetails": "The vulnerability resides in the firewall.so binary invoked via the CGI script located at /cgi-bin/cstecgi.cgi on the TOTOLINK A800R device. Specifically, the flaw occurs within the setIpQosRules function when processing incoming HTTP requests containing QoS configuration parameters.\nThe root cause of the vulnerability is the lack of proper length validation and bounds checking on the Comment argument before writing the input data into a fixed-size stack-allocated buffer. When an attacker submits an overly long string via the vulnerable parameter, the input exceeds the buffer capacity, overwriting adjacent stack memory structures, including saved frame pointers and return addresses.\nThe attack vector is network-based, allowing a remote threat actor to interact directly with the exposed web management interface. Exploitation can be executed without prior authentication or privileged access, depending on the exposure configuration of the administrative interface. The attacker crafts a malicious HTTP request embedding shellcode or return-oriented programming payloads within the Comment parameter of the setIpQosRules routine.\nWhen the binary processes the request, the unsecured memory copy operation triggers the stack-based buffer overflow. By carefully controlling the overflowed data, the attacker can hijack the control flow of the execution thread, redirecting it to the injected shellcode. Post-exploitation impact includes full system compromise, persistent unauthorized access, firmware tampering, and potential lateral movement within the local network connected to the vulnerable router."
}