Description

A vulnerability was detected in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setMacQos of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Performing a manipulation of the argument macAddress results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T09:16:47.883Z",
  "pubdate": "2026-08-14T09:16:47.883Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability has been identified in TOTOLINK A800R version 4.1.2cu.5137_B20200730. The security flaw specifically resides within the setMacQos function inside the firewall.so component, which is invoked via the CGI binary located at /cgi-bin/cstecgi.cgi. An unauthenticated remote attacker can exploit this vulnerability by manipulating the macAddress parameter with maliciously crafted input that exceeds the allocated buffer size. Successful exploitation of this vulnerability leads to a stack-based buffer overflow condition, which can result in denial of service or potentially remote code execution on the target device. Given that the exploit is currently public, the risk implication is exceptionally high, allowing threat actors to compromise vulnerable routers exposed to the network without requiring prior authentication or privileged access.",
  "technicalDetails": "The vulnerability is classified as a stack-based buffer overflow stemming from inadequate bounds checking on user-supplied input within the setMacQos function of the firewall.so component. The affected binary processes incoming HTTP requests via the Common Gateway Interface (CGI) script located at /cgi-bin/cstecgi.cgi. During the handling of MAC-based Quality of Service (QoS) configurations, the application extracts the macAddress argument from the request parameters.\nThe root cause of the vulnerability lies in the unsafe copy operation or string manipulation routine utilized to process the macAddress argument. When a threat actor submits a specially crafted HTTP request containing an excessively long string within the macAddress parameter, the input is copied into a fixed-size stack buffer without proper validation of its length. This causes the input data to overflow the boundaries of the stack-allocated buffer, overwriting adjacent stack memory structures, which typically include saved frame pointers and return addresses.\nThe attack flow proceeds as follows: First, the remote attacker crafts an HTTP request targeting /cgi-bin/cstecgi.cgi with parameters directed at the setMacQos function. Second, the attacker injects an oversized payload into the macAddress argument. Third, the firewall.so component processes the request and improperly handles the parameter, triggering the stack overflow when the data is written to the stack. Finally, the instruction pointer can be hijacked if the return address is successfully overwritten with malicious shellcode or redirected to existing memory instructions, potentially achieving arbitrary code execution with the privileges of the web server or underlying daemon.\nThe network exposure for this vulnerability is remote, meaning attackers do not require physical access to the TOTOLINK A800R device and can potentially execute the exploit over the WAN or LAN interfaces depending on the router's configuration and management exposure. The affected software version is 4.1.2cu.5137_B20200730. No authentication or elevated privileges are required to initiate the attack vector, lowering the barrier to entry for malicious actors seeking to compromise vulnerable hardware."
}