Is CVE-2026-44089 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44089 being exploited in the wild.

How severe is CVE-2026-44089?

Informational severity, with a CVSS score of 9.4, published 23 June 2026.

Which products and versions are affected?

TOTOLINK EX1200L 9.3.5u.6146_B20201023.

Is there a fix for CVE-2026-44089?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44089 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-44089?

Check whether you run TOTOLINK EX1200L at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44089: Totolink EX1200L buffer overflow in cstecgi.cgi login

CVE-2026-44089 · Severity: info · CVSS 9.4 · Published 2026-06-23

The Totolink EX1200L router, a device used to extend wireless network coverage, contains a critical security flaw in its login interface. An attacker on the same network can exploit this to crash the device or take full control of it without needing a password. This could lead to the theft of data passing through the router, permanent damage to the hardware (bricking), or unauthorized access to other devices on the network.

Technologies: TOTOLINK EX1200L. Vendors: TOTOLINK.

Quick answers

Is CVE-2026-44089 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44089 being exploited in the wild.
How severe is CVE-2026-44089?: Informational severity, with a CVSS score of 9.4, published 23 June 2026.
Which products and versions are affected?: TOTOLINK EX1200L 9.3.5u.6146_B20201023.
Is there a fix for CVE-2026-44089?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44089 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-44089?: Check whether you run TOTOLINK EX1200L at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow (CWE-121) exists in the Totolink EX1200L router within the 'cgi-bin/cstecgi.cgi' endpoint. The vulnerability is located in the login functionality and can be triggered by an unauthenticated attacker with network access to the device's management interface (typically via the adjacent network). Successful exploitation allows the attacker to execute arbitrary code with root privileges, leading to full system compromise, data interception, or permanent denial of service (bricking). The vulnerability has been confirmed in firmware version 9.3.5u.6146_B20201023; however, as vendor contact attempts were unsuccessful, a patch is not currently available.

Affected products

Totolink EX1200L 9.3.5u.6146_B20201023

Timeline

2026-06-23: advisory: Advisory published by CERT.PL
2026-06-23: disclosed: CVE-2026-44089 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.