Executive brief
TOTOLINK N600R is a wireless router used to provide internet connectivity in homes and small offices. A stack-based buffer overflow vulnerability in the router's web configuration interface allows an attacker to crash the device or execute arbitrary code by sending a specially crafted hostname parameter, potentially giving complete control over the router and any networks it serves.
Technical details
The vulnerability is a stack-based buffer overflow in the setSystemConfig function of the CGI handler (/cgi-bin/cstecgi.cgi) in TOTOLINK N600R firmware version 4.3.0cu.7647_B20210106. The vulnerable code does not properly validate the length of the Hostname argument before copying it into a fixed-size stack buffer, allowing an attacker to overflow the buffer. The attack requires network access to the router's web interface and can be executed without authentication. A successful exploit allows remote code execution with the privileges of the CGI process, potentially leading to complete device compromise.
Affected products
- TOTOLINK N600R 4.3.0cu.7647_B20210106
Timeline
- 2026-08-25: disclosed: Vulnerability publicly disclosed
- 2026-08-25: other: Exploit code publicly available on GitHub