Description

A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-31T05:17:06.393Z",
  "pubdate": "2026-08-31T05:17:06.393Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability has been identified in the TOTOLINK NR1800X router, specifically within the cstecgi.cgi binary.\nThe flaw resides in the setUploadSetting function and is triggered via improper handling of the FileName argument.\nThis vulnerability allows remote, unauthenticated attackers to execute arbitrary code on the target device.\nSuccessful exploitation results in full system compromise, potentially leading to unauthorized access, remote code execution (RCE), and denial of service (DoS) conditions.\nGiven that the exploit code is publicly available, the risk of exploitation by malicious actors is high.\nThe vulnerability affects firmware version 9.1.0u.6681_B20230703, and the attack vector is network-accessible, requiring no prior authentication or administrative privileges to execute the malicious payload.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow occurring within the setUploadSetting function of the /cgi-bin/cstecgi.cgi binary.\nThe root cause is an insecure implementation of memory management where user-supplied input provided to the FileName argument is copied into a fixed-size stack buffer without adequate bounds checking or length validation.\nWhen a specially crafted, oversized input string is provided to the FileName parameter during a request, it overwrites adjacent memory on the call stack, including critical control data such as the saved return address (or stored frame pointer).\nThe attack flow initiates with a remote HTTP request directed at the cstecgi.cgi endpoint. The attacker submits a malicious payload designed to overflow the target buffer while simultaneously overwriting the instruction pointer (EIP/RIP) to hijack the execution flow.\nBy redirecting the instruction pointer to an attacker-controlled address—such as the address of a NOP sled or a shellcode payload injected earlier in the stack frame or into other buffer areas—the attacker can achieve arbitrary code execution.\nBecause the binary is a CGI application executing in the context of the device's web server process, the payload executes with the privileges of the web service, which are typically elevated enough to perform administrative actions, modify configurations, or establish a persistent backdoor.\nThis vulnerability is particularly severe due to its remote exploitation capability, which does not require authentication, making it accessible to any actor with network visibility to the device's management interface.\nThe exploit exploits the lack of modern compiler protections such as Stack Canaries, Position Independent Executables (PIE), or Address Space Layout Randomization (ASLR), which would otherwise mitigate the impact of such memory corruption vulnerabilities.\nPost-exploitation impact includes full control over the router, the ability to sniff local network traffic, facilitate man-in-the-middle attacks, or utilize the device as a botnet node for distributed attacks."
}