Description

A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component wps.so. The manipulation of the argument pin results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T18:17:24.037Z",
  "pubdate": "2026-08-14T18:17:24.037Z",
  "executiveSummary": "A critical security flaw has been identified in the TOTOLINK A800R router running firmware version 4.1.2cu.5137_B20200730. The vulnerability resides within the setWiFiWpsConfig function handled by the wps.so component via the /cgi-bin/cstecgi.cgi endpoint. Specifically, improper handling of the pin argument leads to a stack-based buffer overflow.\nThis vulnerability exposes the affected device to remote exploitation over the network without requiring authentication, depending on the management interface exposure. Successful exploitation allows a remote attacker to overwrite memory on the stack, potentially leading to arbitrary code execution, denial of service (DoS), or complete device compromise. Given that an exploit has been released to the public, the risk of active exploitation in the wild is significantly elevated.\nThe combination of network exposure, lack of authentication prerequisites for the endpoint, and the availability of public exploit code elevates the operational risk profile, necessitating immediate defensive measures to prevent potential perimeter breaches and device takeovers.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow located in the wps.so component of the TOTOLINK A800R firmware version 4.1.2cu.5137_B20200730. The flaw specifically manifests within the setWiFiWpsConfig function when processing requests sent to the Common Gateway Interface binary located at /cgi-bin/cstecgi.cgi.\nThe root cause of the vulnerability stems from inadequate bounds checking and input validation on the pin argument supplied by the user within the HTTP request payload. When the application parses the input parameter destined for the Wi-Fi Protected Setup (WPS) configuration routine, it copies the untrusted data into a fixed-size stack buffer without properly verifying its length.\nThe attack flow proceeds as follows: An unauthenticated remote attacker crafts a malicious HTTP request targeting the /cgi-bin/cstecgi.cgi endpoint. The request includes an oversized string payload injected into the pin parameter. When the wps.so component executes the setWiFiWpsConfig function and processes this input, the insecure copy operation (such as an unsafe string manipulation function like strcpy or sprintf) writes past the boundary of the allocated stack buffer.\nThis memory corruption overwrites adjacent stack data, including the saved frame pointer and the return address. By precisely crafting the payload, an attacker can hijack the execution flow upon function return, redirecting execution to malicious shellcode or leveraging return-oriented programming (ROP) chains.\nThe network exposure of this vulnerability is high if the router's web management interface is accessible from the WAN or untrusted local networks. The vulnerability requires zero privileges and no prior authentication, lowering the barrier to entry for potential threat actors. Post-exploitation impact includes full system compromise, persistent backdoor installation, and potential pivoting into internal network segments connected to the compromised routing device."
}