Description

A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. Executing a manipulation of the argument Comment can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T17:17:35.753Z",
  "pubdate": "2026-08-14T17:17:35.753Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability has been identified in the TOTOLINK A800R router running firmware version 4.1.2cu.5137_B20200730. The vulnerability resides within the setStaticDhcpConfig function handled by the /cgi-bin/cstecgi.cgi binary, specifically inside the lan.so component. An unauthenticated remote attacker can exploit this flaw by supplying a maliciously crafted input to the Comment argument during static DHCP configuration parsing. Successful exploitation of this vulnerability leads to memory corruption, potentially allowing arbitrary code execution, system compromise, or complete denial of service. The attack vector is fully remote over the network, and proof-of-concept exploits have been publicly disclosed, significantly elevating the risk profile for deployed devices. Because this flaw targets core network services exposed via the web management interface, immediate remediation or defensive isolation is strongly advised to prevent exploitation.",
  "technicalDetails": "The vulnerability is classified as a stack-based buffer overflow, stemming from unsafe memory handling operations within the setStaticDhcpConfig function of the lan.so library. When the /cgi-bin/cstecgi.cgi binary processes incoming Common Gateway Interface (CGI) requests related to the static DHCP configuration module, it parses parameters supplied by the client. Specifically, the processing routine fails to adequately bound-check or sanitize the length of the input string assigned to the Comment parameter before copying it into a fixed-size stack buffer.\nDuring the attack flow, a remote attacker crafts an HTTP request containing an oversized payload within the Comment argument. Because the network exposure of the /cgi-bin/cstecgi.cgi endpoint is directly accessible via the management interface, the request is routed to the embedded web server and handed off to the CGI handler. The vulnerable lan.so component reads the excessive payload and executes a memory copy operation, such as an unsafe string copy, without verifying that the destination buffer can accommodate the input size.\nAs the payload exceeds the allocated boundaries of the stack buffer, adjacent memory structures, including saved frame pointers and return addresses, are overwritten. When the setStaticDhcpConfig function attempts to return execution control, the modified return address redirects the instruction pointer to attacker-controlled memory locations. Depending on the architecture and mitigating controls present in the firmware binary, this enables the execution of arbitrary shellcode or malicious payloads with the privileges of the web server or underlying system daemon. Post-exploitation impact includes full device takeover, modification of network configurations, interception of traffic, or persistent system destabilization resulting in a denial of service."
}