Is CVE-2026-82539 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82539 being exploited in the wild.

How severe is CVE-2026-82539?

Critical severity, with a CVSS score of 9.1, published 30 August 2026.

Which products and versions are affected?

TOTOLINK A720r V4.1.5cu.630_B20250509.

Is there a fix for CVE-2026-82539?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82539 attacked?

It is attacked over the network.

Am I affected by CVE-2026-82539?

Check whether you run TOTOLINK A720r at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82539: TOTOLINK A720R stack buffer overflow in MAC filtering

CVE-2026-82539 · Severity: critical · CVSS 9.1 · Published 2026-08-30

The TOTOLINK A720R is a wireless router used to provide network connectivity in homes and small businesses. A buffer overflow vulnerability in its MAC filtering feature allows an authenticated administrator to execute arbitrary code paths on the device, potentially compromising network security and enabling unauthorized access or system compromise.

Technologies: TOTOLINK A720r. Vendors: TOTOLINK.

Quick answers

Is CVE-2026-82539 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82539 being exploited in the wild.
How severe is CVE-2026-82539?: Critical severity, with a CVSS score of 9.1, published 30 August 2026.
Which products and versions are affected?: TOTOLINK A720r V4.1.5cu.630_B20250509.
Is there a fix for CVE-2026-82539?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82539 attacked?: It is attacked over the network.
Am I affected by CVE-2026-82539?: Check whether you run TOTOLINK A720r at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow exists in the cstecgi.cgi firmware binary within the setMacFilterRules function. The vulnerability is triggered by supplying an overly long value in the desc parameter, which is copied into a fixed-size stack buffer using strcpy() without bounds checking, overwriting the saved return address. The device is compiled without stack canaries and PIE, allowing reliable control flow hijacking. An authenticated administrator with network access can redirect execution to existing code paths (ROP-style) to enable services like Telnet, reboot the system, or clear logs. No patch availability is mentioned in the advisory.

Affected products

TOTOLINK A720R V4.1.5cu.630_B20250509

Timeline

2026-08-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.