# CVE-2026-44089: Totolink EX1200L buffer overflow in cstecgi.cgi login

Source: https://junglewise.ai/threats/cve-2026-44089-totolink-ex1200l-buffer-overflow-in-cstecgi-cgi-login  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-44089 · Severity: info · CVSS 9.4 · Published 2026-06-23

The Totolink EX1200L router, a device used to extend wireless network coverage, contains a critical security flaw in its login interface. An attacker on the same network can exploit this to crash the device or take full control of it without needing a password. This could lead to the theft of data passing through the router, permanent damage to the hardware (bricking), or unauthorized access to other devices on the network.

Technologies: [TOTOLINK EX1200L](https://junglewise.ai/threats/technologies/ex1200l). Vendors: [TOTOLINK](https://junglewise.ai/threats/vendors/totolink).

## Quick answers

**Is CVE-2026-44089 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44089 being exploited in the wild.

**How severe is CVE-2026-44089?** Informational severity, with a CVSS score of 9.4, published 23 June 2026.

**Which products and versions are affected?** TOTOLINK EX1200L 9.3.5u.6146_B20201023.

**Is there a fix for CVE-2026-44089?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44089 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-44089?** Check whether you run TOTOLINK EX1200L at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow (CWE-121) exists in the Totolink EX1200L router within the 'cgi-bin/cstecgi.cgi' endpoint. The vulnerability is located in the login functionality and can be triggered by an unauthenticated attacker with network access to the device's management interface (typically via the adjacent network). Successful exploitation allows the attacker to execute arbitrary code with root privileges, leading to full system compromise, data interception, or permanent denial of service (bricking). The vulnerability has been confirmed in firmware version 9.3.5u.6146_B20201023; however, as vendor contact attempts were unsuccessful, a patch is not currently available.

## Affected products

- Totolink EX1200L 9.3.5u.6146_B20201023

## Timeline

- 2026-06-23: advisory: Advisory published by CERT.PL
- 2026-06-23: disclosed: CVE-2026-44089 published to NVD

## References

- [https://cert.pl/en/posts/2026/06/CVE-2026-44089](https://cert.pl/en/posts/2026/06/CVE-2026-44089)
- [https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/217/ids/36.html](https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/217/ids/36.html)

## Related threats

- [TOTOLINK EX1200L null pointer dereference in setWizardCfg](https://junglewise.ai/threats/cve-2026-75013-totolink-ex1200l-null-pointer-dereference-in-setwizardcfg)
- [TOTOLINK EX1200L null pointer dereference in Password Configuration Handler](https://junglewise.ai/threats/cve-2026-75012-totolink-ex1200l-null-pointer-dereference-in-password)