CVE-2026-114382 in EX200
Summary
by MITRE • 10/21/2026
A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. The manipulation of the argument Comment results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in TOTOLINK EX200 firmware version 5.2.3c.7200 represents a critical security flaw within the device's web management interface, specifically located in the setStaticDhcpConfig function of the lan.so component which is accessed via /cgi-bin/cstecgi.cgi. This vulnerability stems from an improper handling of user-supplied input where the Comment argument passed to this function fails to undergo adequate bounds checking before being copied into a fixed-size stack buffer. As a result, providing a string that exceeds the allocated memory space causes data to spill over into adjacent areas of the stack, leading to a classic stack-based buffer overflow condition. This type of flaw is categorized under CWE-121 which denotes a stack-based buffer overflow, and it typically arises from legacy C programming practices where developers assume input will always fit within predefined limits without implementing rigorous validation mechanisms.
The operational impact of this vulnerability is severe due to its remote exploitable nature. An attacker does not need physical access or prior authentication credentials if the web interface allows unauthenticated access to certain CGI endpoints, which is a common configuration in many consumer-grade routers for initial setup or specific management tasks. By crafting a malicious HTTP request containing an oversized Comment parameter, an adversary can overwrite critical stack memory locations such as the return address and saved frame pointer. This manipulation allows the attacker to redirect program execution flow to arbitrary code injected via the overflowed buffer data itself. Consequently, this enables remote code execution with the privileges of the web server process running on the router, which often operates with high-level system access or root permissions depending on the device's architecture and security configuration.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1059 Command and Scripting Interpreter as well as T1203 Exploitation for Client Execution because it facilitates the initial compromise of network infrastructure devices. The fact that an exploit has been released to the public significantly lowers the barrier to entry for malicious actors, increasing the likelihood of automated scanning and exploitation campaigns targeting vulnerable IoT devices across the internet. Attackers can leverage this flaw to establish persistent backdoors, pivot into internal networks, or use the compromised router as a botnet node for distributed denial-of-service attacks. The availability of public exploits means that defensive measures must be implemented immediately rather than waiting for vendor patches, especially given the long lifecycle and often neglected update cycles typical of such networking hardware.
Mitigation strategies should prioritize immediate isolation of affected devices from untrusted networks until an official firmware patch is available and verified by the manufacturer. Administrators should review router configurations to disable remote management features if they are not strictly necessary, thereby reducing the attack surface exposed to external threats. If remote access must be maintained, implementing strict IP whitelisting for administrative interfaces can provide a layer of defense in depth. Furthermore, organizations relying on these devices should consider replacing them with models that demonstrate stronger security engineering practices and regular vulnerability management support. Network monitoring solutions should also be configured to detect anomalous traffic patterns indicative of buffer overflow attempts or unusual outbound connections from the router, which may signal successful exploitation and subsequent command-and-control activity.