Description

A security vulnerability has been detected in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Such manipulation of the argument Comment leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T08:17:38.427Z",
  "pubdate": "2026-08-14T08:17:38.427Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability has been identified in the TOTOLINK A800R router running firmware version 4.1.2cu.5137_B20200730. The flaw specifically resides within the firewall.so component, inside the setMacFilterRules function accessed via /cgi-bin/cstecgi.cgi.\nThe vulnerability is triggered by inadequate boundary checking on the Comment argument during MAC filter rule manipulation. An unauthenticated remote attacker can exploit this weakness by submitting a maliciously crafted payload containing an excessively large string to the vulnerable parameter.\nSuccessful exploitation of this stack-based buffer overflow can lead to memory corruption, potentially allowing remote code execution, arbitrary control flow hijacking, or causing a complete denial of service (DoS) of the device.\nBecause the attack vector is network-accessible and exploits a publicly disclosed methodology, the risk is critical. Affected systems require immediate attention through vendor-supplied patches or administrative restriction of management interfaces.",
  "technicalDetails": "The vulnerability exists within the firewall.so shared object, specifically inside the setMacFilterRules function handling requests processed by the CGI binary located at /cgi-bin/cstecgi.cgi.\nThe root cause of the vulnerability is an insecure memory handling operation, such as an unsafe string copy or concatenation routine (e.g., strcpy or sprintf), where input supplied via the Comment argument is written to a fixed-size stack buffer without proper length validation.\nAttackers can leverage this condition by sending a specially crafted HTTP request targeting the /cgi-bin/cstecgi.cgi endpoint, supplying an oversized string in the Comment field of the MAC filtering configuration payload.\nAs the overly long input is processed and copied into the stack buffer, it overflows the allocated boundary, overwriting adjacent stack memory structures, including the saved frame pointer and the return address.\nWhen the setMacFilterRules function attempts to return execution to its caller, the CPU loads the overwritten return address from the stack into the instruction pointer (PC), allowing the attacker to redirect execution flow to shellcode contained within the payload or to existing gadget chains for Return-Oriented Programming (ROP).\nThe affected product and version is TOTOLINK A800R 4.1.2cu.5137_B20200730. The attack flow is initiated remotely over the network without requiring prior authentication or elevated privileges, depending on the exposure of the administrative web interface.\nPost-exploitation impact includes full system compromise, persistent unauthorized access, manipulation of network traffic, or continuous denial of service via repeated crashes of the underlying web daemon or system services."
}