Description

A weakness has been identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi of the component product.so. This manipulation of the argument File causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T08:17:38.263Z",
  "pubdate": "2026-08-14T08:17:38.263Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability has been identified in the TOTOLINK A800R router running firmware version 4.1.2cu.5137_B20200730. The vulnerability resides within the UploadCustomModule function processed by the product.so binary via the /cgi-bin/cstecgi.cgi endpoint. Specifically, improper handling of the File argument enables remote attackers to supply overly large inputs that corrupt the stack memory space.\nThe successful exploitation of this flaw can lead to arbitrary code execution, system compromise, and potential denial of service conditions affecting the core routing and networking functionalities of the device. Given that the attack vector is network-accessible and public exploits are readily available, the risk to exposed devices is severe. Attackers can execute arbitrary instructions remotely without requiring prior authentication, depending on the interface exposure, thereby posing an immediate threat to network perimeter security.",
  "technicalDetails": "The vulnerability is classified as a stack-based buffer overflow, stemming from unsafe memory copy operations or string manipulations performed on user-supplied input within the UploadCustomModule function. This function is hosted inside the product.so component and is exposed via the /cgi-bin/cstecgi.cgi Common Gateway Interface handler.\nDuring the execution flow, the application processes HTTP requests directed at the CGI endpoint. When parsing the input parameters, the File argument is extracted and handled by UploadCustomModule. The underlying C/C++ implementation fails to enforce strict boundary checks or validate the exact length of the incoming File parameter before copying the data into a fixed-size stack buffer allocated within the function's stack frame.\nAn unauthenticated remote attacker can exploit this weakness by crafting a malicious HTTP request containing an excessively long payload within the File argument. When the binary processes this oversized input, the data overflows the bounds of the destination buffer, sequentially overwriting adjacent stack memory structures, including saved frame pointers and return addresses.\nBy meticulously structuring the payload, an attacker can control the program counter upon function return, redirecting execution flow to arbitrary code segments, such as shellcode included within the payload or utilizing return-oriented programming (ROP) chains. The network exposure is direct, as the /cgi-bin/cstecgi.cgi interface is typically accessible over the local network or wide area network depending on device configuration. The post-exploitation impact includes complete administrative control over the affected TOTOLINK A800R device, allowing the adversary to intercept traffic, modify device configurations, or pivot into the internal network."
}