Executive brief
A security vulnerability exists in the firmware of ToToLink LR1200GB and NR1800X routers, which are devices used to provide home and office internet connectivity. An attacker can exploit the router's web management interface to cause a system crash or potentially take control of the device. This attack can be performed remotely without needing a username or password, potentially disrupting internet service or compromising the security of the local network.
Technical details
A stack-based buffer overflow vulnerability exists in the cstecgi.cgi binary (specifically within the sub_42F32C function) of ToToLink LR1200GB and NR1800X routers. The vulnerability is caused by the unsafe use of the sprintf() function when processing the 'lang' and 'HelpUrl' parameters retrieved via websGetVar(). The application fails to validate the length of these user-supplied strings before copying them into a fixed-size 128-byte stack buffer (v7). An unauthenticated remote attacker can exploit this by sending a specially crafted HTTP POST request to /cgi-bin/cstecgi.cgi, leading to memory corruption, denial of service, or potential remote code execution. As of the advisory date, no official patch has been confirmed.
Affected products
- ToToLink LR1200GB firmware V9.1.0u.6619_B20230130
- ToToLink NR1800X firmware V9.1.0u.6681_B20230703
Timeline
- 2025-11-13: advisory: NVD published the CVE record
- 2025-11-13: disclosed: Public PoC published on GitHub