Description

A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T18:17:23.883Z",
  "pubdate": "2026-08-14T18:17:23.883Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability has been identified in the TOTOLINK A800R router running firmware version 4.1.2cu.5137_B20200730. The vulnerability resides within the firewall.so component, specifically inside the setUrlFilterRules function exposed via the /cgi-bin/cstecgi.cgi endpoint.\nThe flaw stems from the improper handling of the url argument, which fails to perform adequate bounds checking before copying user-supplied input into a fixed-size stack buffer. Successful exploitation of this vulnerability allows a remote attacker to achieve a stack-based buffer overflow, potentially leading to arbitrary code execution, denial of service, or complete system compromise.\nThe attack can be initiated remotely over the network without requiring authentication, depending on the management interface exposure. Given that a public exploit is currently available, the risk implications are severe. Threat actors can readily weaponize this flaw to compromise vulnerable routers, altering firewall rules or hijacking device execution flow.\nImmediate remediation is critical, and administrators should restrict administrative access to trusted internal networks, disable remote management capabilities, and apply vendor-supplied firmware patches if available.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow affecting the firewall.so component of the TOTOLINK A800R firmware version 4.1.2cu.5137_B20200730.\nThe root cause of the vulnerability lies in the setUrlFilterRules function, which processes incoming Common Gateway Interface (CGI) requests routed through the /cgi-bin/cstecgi.cgi binary. Specifically, when parsing HTTP requests containing URL filtering parameters, the function extracts the url argument from the input payload.\nDuring the processing of this argument, the application executes unsafe memory copy operations, such as standard string handling routines (e.g., strcpy or sprintf), without verifying the length of the input string against the allocated destination buffer on the stack. Because the url parameter accepts arbitrary strings supplied by the user, an attacker can transmit an oversized payload designed to exceed the fixed-length buffer capacity.\nThe attack flow proceeds as follows: First, the remote attacker crafts a malicious HTTP request targeting the /cgi-bin/cstecgi.cgi endpoint, invoking the setUrlFilterRules action handler. Within the payload, the attacker populates the url argument with a carefully constructed string containing an excess of bytes designed to overwrite adjacent stack memory. This payload typically includes padding to reach the return address offset, followed by malicious shellcode or redirection instructions.\nSecond, the web server daemon parses the request and passes the malicious parameter into the firewall.so library for internal processing. The vulnerable setUrlFilterRules function copies the oversized url string into the local stack buffer without bounds validation.\nThird, as the memory copy operation proceeds past the boundaries of the buffer, it overwrites critical stack data, including the saved frame pointer and the return address. When the function execution completes and attempts to return control to the calling function, the CPU loads the attacker-controlled instruction pointer from the overwritten return address into the program counter.\nThis hijacking of the execution flow enables the attacker to execute arbitrary code with the privileges of the underlying web server process, which typically runs with high or root-level privileges on embedded networking equipment. Post-exploitation impact includes full device takeover, modification of firewall rules, interception of network traffic, and potential pivoting into the local internal network."
}