CVE-2026-19812 in A800R
Summary
by MITRE • 08/14/2026
A weakness has been identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi of the component product.so. This manipulation of the argument File causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability identified in TOTOLINK A800R firmware version 4.1.2cu.5137_B20200730 represents a critical stack-based buffer overflow weakness that manifests within the UploadCustomModule function of the cstecgi.cgi component. This flaw exists specifically in the product.so library and can be exploited through manipulation of the File argument parameter during the upload process. The vulnerability resides in the cgi-bin directory structure, making it accessible through standard web interface interactions that utilize the cstecgi.cgi script for various administrative functions. The buffer overflow occurs when user-supplied input exceeds the allocated stack memory space, creating potential for arbitrary code execution and system compromise.
The technical exploitation of this vulnerability follows a well-documented attack pattern that aligns with CWE-121 Stack-based Buffer Overflow, which is classified under the broader category of CWE-787 Out-of-bounds Write in the Common Weakness Enumeration catalog. This weakness allows attackers to overwrite adjacent stack memory locations, potentially corrupting program execution flow and enabling privilege escalation or remote code execution. The attack vector is particularly concerning as it operates over a network interface, making it accessible to remote adversaries without physical access requirements. The vulnerability's exploitability score reflects its low complexity and high impact potential, as noted in the ATT&CK framework under T1059 Command and Scripting Interpreter and T1203 Exploitation for Client Execution.
The operational impact of this vulnerability extends beyond simple system compromise into broader network security implications that affect enterprise and consumer deployments alike. Remote exploitation could enable attackers to gain administrative privileges on the affected device, potentially allowing them to modify firmware, establish persistent backdoors, or use the device as a pivot point for further attacks within the local network. The public availability of exploit code significantly amplifies the risk profile, as it removes the barrier to entry for less sophisticated threat actors who may leverage this vulnerability for malicious purposes including but not limited to botnet recruitment, data exfiltration, or network reconnaissance activities.
Mitigation strategies for this vulnerability should prioritize immediate firmware updates from TOTOLINK, as these would contain patches addressing the buffer overflow in the UploadCustomModule function. Network segmentation and access controls should be implemented to limit exposure of affected devices to untrusted networks, while monitoring systems should be deployed to detect anomalous upload activities or attempts to exploit the vulnerable cgi interface. The implementation of input validation controls and stack protection mechanisms within the affected software components would provide additional defense-in-depth layers against similar exploitation attempts. Organizations should also consider implementing network-based intrusion detection systems that can identify and block traffic patterns associated with exploitation attempts targeting this specific vulnerability, aligning with ATT&CK T1071.004 Application Layer Protocol: DNS mitigation strategies to prevent command and control communications from compromised devices.