Description

A vulnerability was detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation results in null pointer dereference. The attack can be launched remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-17T20:16:47.483Z",
  "pubdate": "2026-08-17T20:16:47.483Z",
  "executiveSummary": "A null pointer dereference vulnerability has been identified in the TOTOLINK EX1200L router running firmware version 9.3.5u.6146_B20201023. The vulnerability resides in the setWizardCfg function within the /cgi-bin/cstecgi.cgi binary. Successful exploitation of this flaw allows a remote attacker to trigger a denial of service condition by causing the application or system service to crash.\nThe attack vector is network-based, enabling remote threat actors to launch the exploit without prior authentication depending on the interface exposure. Given that exploit details are now publicly available, the risk implications are elevated for exposed devices. The primary impact is system instability and potential service interruption of the affected network device, requiring administrative intervention or reboot to restore normal operations.",
  "technicalDetails": "The vulnerability is caused by a null pointer dereference flaw originating in the setWizardCfg function located in the /cgi-bin/cstecgi.cgi file of the TOTOLINK EX1200L firmware version 9.3.5u.6146_B20201023. A null pointer dereference occurs when the application attempts to read or write memory through a pointer that does not point to a valid memory address, typically because initialization or error-handling checks failed to validate input data.\nDuring the attack flow, a remote adversary crafts a specialized HTTP request destined for the /cgi-bin/cstecgi.cgi endpoint, specifically interacting with the setWizardCfg function parameters. Upon receiving the malicious payload, the binary processes the input data without proper sanitization or validation of internal pointer references. When the function attempts to dereference a critical pointer that evaluates to NULL due to missing or malformed expected parameters, the operating system generates a segmentation fault.\nThis behavior results in the immediate abnormal termination of the vulnerable process, leading to a denial of service condition for the affected services managed by the CGI binary. The network exposure is explicitly remote, allowing unauthenticated or remotely authenticated attackers—depending on the specific CGI access controls—to trigger the condition over the network stack. Because the exploit mechanism is publicly known, automated scanning or exploitation scripts can be leveraged to repeatedly crash the device, rendering it unresponsive and disrupting network connectivity for dependent clients."
}