CVE-2026-19814 in A800R
Summary
by MITRE • 08/14/2026
A vulnerability was detected in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setMacQos of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Performing a manipulation of the argument macAddress results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability identified in TOTOLINK A800R router firmware version 4.1.2cu.5137_B20200730 represents a critical stack-based buffer overflow flaw within the firewall.so component of the device's web interface. This vulnerability exists in the setMacQos function located at /cgi-bin/cstecgi.cgi and specifically affects the manipulation of the macAddress argument parameter. The flaw allows remote attackers to execute arbitrary code on the affected device by crafting malicious input that exceeds the allocated buffer space, leading to potential system compromise.
The technical exploitation of this vulnerability occurs through the manipulation of the macAddress parameter in the setMacQos function, which operates within the firewall.so module. When an attacker sends a specially crafted request to the /cgi-bin/cstecgi.cgi endpoint with an oversized macAddress argument, the buffer overflow condition is triggered. The stack-based nature of this vulnerability means that the overflow corrupts adjacent memory locations including return addresses and function pointers, potentially allowing attackers to redirect execution flow or inject malicious code.
This remote exploit capability significantly amplifies the threat landscape for affected devices, as it requires no physical access or local network presence to initiate attacks. The public availability of exploitation tools increases the probability of widespread compromise across networks utilizing vulnerable TOTOLINK A800R routers. Attackers can leverage this vulnerability to gain unauthorized access to the device, potentially enabling them to modify router configurations, intercept network traffic, or establish persistent backdoors within the network infrastructure.
The impact extends beyond individual device compromise to encompass broader network security implications, as compromised routers can serve as entry points for lateral movement and advanced persistent threats. This vulnerability aligns with CWE-121 Stack-based Buffer Overflow, which is classified under the Common Weakness Enumeration framework and represents one of the most prevalent and dangerous classes of software vulnerabilities in network devices. The threat model suggests potential mappings to ATT&CK techniques including T1059 Command and Scripting Interpreter for execution, T1071 Application Layer Protocol for communication, and T1566 Phishing for initial access or privilege escalation.
Mitigation strategies should prioritize immediate firmware updates from TOTOLINK to address the identified vulnerability, as well as network segmentation to limit exposure of affected devices. Network administrators should implement strict access controls and monitor for suspicious traffic patterns indicating exploitation attempts. Additional protective measures include disabling unnecessary services, implementing robust firewall rules, and conducting comprehensive network scans to identify potentially compromised devices within the infrastructure. Organizations should also consider deploying intrusion detection systems capable of identifying malicious payloads targeting this specific vulnerability class.