Executive brief
TOTOLINK A800R is a wireless router used by consumers to provide internet connectivity. An attacker can remotely exploit a stack-based buffer overflow vulnerability in the firewall component by sending a specially crafted request with an oversized URL parameter, potentially leading to arbitrary code execution and complete compromise of the device.
Technical details
The vulnerability exists in the setUrlFilterRules function of firewall.so within the /cgi-bin/cstecgi.cgi endpoint. The url parameter is passed directly to strcpy() without length validation, enabling a classic stack-based buffer overflow. The attack is network-reachable and requires no authentication; an attacker can craft a POST request with a long string in the url parameter to overwrite the stack and achieve remote code execution. Proof-of-concept code is publicly available. Patch status for this firmware version (V4.1.2cu.5137_B20200730) is unknown.
Affected products
- TOTOLINK A800R 4.1.2cu.5137_B20200730
Timeline
- 2026-08-14: disclosed