Description

A vulnerability was found in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component ipv6.so. Performing a manipulation of the argument radvdinterfacename results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T17:17:35.560Z",
  "pubdate": "2026-08-14T17:17:35.560Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability has been identified in the TOTOLINK A800R router running firmware version 4.1.2cu.5137_B20200730. The flaw specifically resides within the setRadvdCfg function handled by the ipv6.so component via the /cgi-bin/cstecgi.cgi endpoint. An unauthenticated remote attacker can exploit this vulnerability by supplying a maliciously crafted radvdinterfacename argument, leading to arbitrary code execution and potential full system compromise. The vulnerability presents a severe risk due to remote network exposure and the public availability of exploits targeting this flaw, allowing malicious actors to compromise network perimeter devices without prior access or authentication.",
  "technicalDetails": "The vulnerability is caused by insecure handling of input data within the setRadvdCfg function located in the ipv6.so shared object, which processes requests submitted to the /cgi-bin/cstecgi.cgi Common Gateway Interface binary. Specifically, the function fails to perform adequate bounds checking and input validation on the radvdinterfacename parameter before copying the provided string into a fixed-size stack buffer. When an attacker submits an excessively long string via the radvdinterfacename argument, a stack-based buffer overflow occurs, overwriting adjacent memory structures on the stack, including saved frame pointers and return addresses.\nThe attack vector is network-based, allowing remote adversaries to interact directly with the HTTP interface exposed by the router. Exploitation can be initiated remotely without requiring prior authentication or administrative privileges, significantly lowering the attack complexity. By carefully crafting the input payload, an attacker can hijack the control flow of the execution thread upon function return, redirecting execution to shellcode or leveraging return-oriented programming (ROP) chains.\nThe post-exploitation impact includes complete loss of confidentiality, integrity, and availability of the affected TOTOLINK A800R device. Successful execution yields arbitrary command execution within the context of the running binary, which typically possesses high privileges on embedded firmware architectures. This grants the attacker persistent control over the networking hardware, enabling malicious traffic redirection, man-in-the-middle attacks, and lateral movement into the internal local area network."
}