Description

A flaw has been found in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected by this vulnerability is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Executing a manipulation of the argument urlKeyword can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T09:16:48.880Z",
  "pubdate": "2026-08-14T09:16:48.880Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability has been identified within the firewall.so component of TOTOLINK A800R version 4.1.2cu.5137_B20200730. The flaw specifically resides in the setParentalRules function when processing input passed to the cgi-bin/cstecgi.cgi endpoint.\nThe vulnerability allows remote attackers to trigger a buffer overflow condition by manipulating the urlKeyword argument. Successful exploitation of this flaw can lead to memory corruption, potentially resulting in remote code execution and full compromise of the affected routing device.\nGiven that the vulnerability is remotely exploitable and exploit code has been publicly published, the risk level is high. The attack requires network connectivity to the target device's web management interface, though specific authentication requirements are contingent on the implementation of the CGI endpoint.\nOrganizations and users deploying the affected TOTOLINK A800R firmware version face significant security risks, including potential unauthorized network access, device takeover, and malicious traffic manipulation.",
  "technicalDetails": "The vulnerability is classified as a stack-based buffer overflow, stemming from unsafe handling of user-supplied input within the firewall.so binary of the TOTOLINK A800R firmware version 4.1.2cu.5137_B20200730.\nThe vulnerable component is the cgi-bin/cstecgi.cgi binary, which handles various administrative and configuration actions via Common Gateway Interface (CGI) requests. Specifically, the function setParentalRules fails to properly bound-check or sanitize the length of the urlKeyword argument supplied by the user.\nWhen an attacker crafts a malicious HTTP request containing an excessively long string within the urlKeyword parameter, the input is copied into a fixed-size stack buffer without adequate length validation. This memory operation overwrites adjacent stack variables, the saved frame pointer, and the return address.\nThe attack flow proceeds as follows: First, the remote attacker constructs a specialized HTTP request directed at the /cgi-bin/cstecgi.cgi endpoint, targeting the parental control configuration functionality. Second, the payload incorporates a carefully structured sequence designed to overflow the buffer allocated for the urlKeyword argument within the setParentalRules function. Third, upon processing the input, the underlying function copies the oversized data into the stack buffer, overwriting the execution control data.\nFinally, when the setParentalRules function attempts to return execution, the overwritten return address redirects the instruction pointer to attacker-controlled shellcode or a targeted return-oriented programming (ROP) chain, facilitating arbitrary code execution with the privileges of the web server process.\nThe network exposure is remote, as the CGI endpoint is accessible via the device's web management interface. With exploit material publicly available, threat actors can automate the delivery of the malicious payload against exposed instances of the TOTOLINK A800R."
}