CVE-2026-114383 in EX200
Summary
by MITRE • 10/21/2026
A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. This manipulation of the argument macAddress causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in TOTOLINK EX200 firmware version 5.2.3c.7200 represents a critical security flaw within the device's web management interface, specifically affecting the wireless configuration subsystem. The root cause lies in the function setWiFiAclAddConfig located within the /cgi-bin/cstecgi.cgi script, which is part of the wireless.so component responsible for handling network access control list operations. This function processes user-supplied input to add MAC address entries to an access control list but fails to adequately validate or sanitize the length of the macAddress argument before copying it into a fixed-size buffer on the stack.
This lack of bounds checking results in a classic stack-based buffer overflow, categorized under CWE-120: Buffer Copy without Checking Size of Input. When an attacker provides a macAddress string that exceeds the allocated buffer size, the excess data overwrites adjacent memory locations on the call stack. This corruption can overwrite critical control flow data such as return addresses or function pointers stored in the frame pointer area. Because this functionality is exposed through a CGI script accessible via HTTP requests, the vulnerability allows for remote exploitation without requiring prior authentication if the device's web interface permits unauthenticated access to certain configuration endpoints, which is common in many IoT devices due to misconfigurations or legacy design choices.
The operational impact of successfully exploiting this stack-based buffer overflow is severe and potentially catastrophic. By carefully crafting the malicious input payload, an attacker can achieve arbitrary code execution on the target device with the privileges of the web server process, typically root level in embedded Linux environments. This grants full control over the router's operating system, allowing the adversary to install persistent backdoors, pivot into internal network segments, exfiltrate sensitive data traversing the network, or use the compromised device as part of a botnet for distributed denial-of-service attacks. The fact that an exploit has already been made publicly available significantly lowers the barrier to entry for attackers, increasing the likelihood of automated scanning and exploitation campaigns targeting vulnerable devices across the internet.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK techniques related to initial access via web applications and subsequent privilege escalation through memory corruption exploits. The remote nature of the attack means that no physical proximity or local network access is required for an attacker to initiate the compromise, provided they can reach the device's IP address over TCP port 80 or 443. This characteristic makes it particularly dangerous in residential and small business environments where routers are often directly exposed to the public internet with weak default credentials or no authentication on administrative interfaces.
Mitigation strategies must focus primarily on immediate patching by updating the TOTOLINK EX200 firmware to a version that addresses this buffer overflow issue, ensuring that proper input validation is implemented in the setWiFiAclAddConfig function. In cases where an update is not immediately available or feasible, network-level controls should be employed to restrict access to the device's management interface. This includes disabling remote administration features if they are not strictly necessary and placing the router behind a firewall that blocks external HTTP/HTTPS traffic from reaching its internal IP address. Additionally, implementing strict MAC filtering at the perimeter can provide an additional layer of defense, although it should be viewed as a compensating control rather than a primary fix since MAC addresses can be spoofed if the underlying buffer overflow is exploited to gain deeper system access.