Description

A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The affected element is the function setSystemConfig of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument Hostname leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-25T23:17:59.490Z",
  "pubdate": "2026-08-25T23:17:59.490Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability exists in the TOTOLINK N600R, specifically within the setSystemConfig function of the /cgi-bin/cstecgi.cgi CGI handler.\nThe vulnerability is triggered by improper handling of the Hostname argument during processing, allowing a remote, unauthenticated attacker to inject a crafted payload into the stack.\nSuccessful exploitation of this flaw can lead to arbitrary code execution, potential system compromise, or a denial-of-service condition affecting the router's stability.\nGiven that the exploit has been disclosed publicly, the risk of exploitation is significantly elevated. The vulnerability is exploitable over the network, requiring no prior authentication, which places the device at substantial risk from external threats.",
  "technicalDetails": "The vulnerability resides in the setSystemConfig function within the /cgi-bin/cstecgi.cgi component of the TOTOLINK N600R (version 4.3.0cu.7647_B20210106). The root cause is a classic stack-based buffer overflow resulting from the insecure handling of the Hostname argument.\nDuring the execution of setSystemConfig, the application fails to perform adequate boundary checks on the input provided to the Hostname parameter before copying it into a fixed-size stack buffer. Because the application does not validate the length of the supplied string, an attacker can provide a specially crafted input that exceeds the allocated buffer capacity.\nThe attack flow proceeds as follows: 1. The attacker crafts a malicious HTTP request targeting the /cgi-bin/cstecgi.cgi endpoint. 2. The payload is embedded within the Hostname argument parameter of the request. 3. Upon receiving the request, the setSystemConfig function processes the argument and copies it into the stack memory without sufficient length verification. 4. The excessive length of the malicious input overwrites critical stack data, including the saved return address (or stored frame pointer) on the stack.\nBy precisely controlling the data used to overwrite the return address, an attacker can redirect the program's execution flow to arbitrary code (such as shellcode) included in the request payload or return into existing code (Return-Oriented Programming - ROP) to bypass non-executable stack protections. This allows the attacker to execute arbitrary commands with the privileges of the CGI process.\nThe impact of a successful exploitation is severe, potentially granting an attacker full control over the affected device. This includes, but is not limited to, unauthorized access to network traffic, interception of sensitive data, modification of device configuration, and persistent compromise. The vulnerability is accessible remotely via the network, and since it resides in a CGI handler, it typically requires no authentication, allowing any network-adjacent or remote attacker to initiate the exploitation process."
}