CVE-2026-19845 in A800R
Summary
by MITRE • 08/14/2026
A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. Executing a manipulation of the argument Comment can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/14/2026
The TOTOLINK A800R router model running firmware version 4.1.2cu.5137_B20200730 contains a critical stack-based buffer overflow vulnerability within its web management interface. This flaw exists in the setStaticDhcpConfig function of the /cgi-bin/cstecgi.cgi script, specifically within the lan.so component that handles local area network configuration parameters. The vulnerability stems from inadequate input validation when processing the Comment argument parameter, which allows malicious actors to manipulate the function's stack memory layout through carefully crafted input sequences.
The technical implementation of this vulnerability involves a classic buffer overflow scenario where user-supplied data exceeds the allocated stack buffer size during the processing of static DHCP configuration settings. When the Comment parameter is passed to the setStaticDhcpConfig function, the application fails to properly validate or sanitize the input length before copying it into a fixed-size stack buffer. This allows attackers to overwrite adjacent stack memory locations including return addresses and function pointers, potentially enabling arbitrary code execution within the router's privilege context.
Remote exploitation of this vulnerability presents significant operational risks for network infrastructure security. Attackers can leverage publicly disclosed exploit codes to remotely compromise affected devices without requiring physical access or authentication credentials. The attack surface extends beyond individual device compromise to potentially enable broader network infiltration, as compromised routers can serve as stepping stones for lateral movement within corporate networks. This vulnerability directly aligns with CWE-121 Stack-based Buffer Overflow and represents a critical threat vector according to the MITRE ATT&CK framework under the technique of "Exploitation for Privilege Escalation" and "Remote Services".
The impact of successful exploitation includes complete device compromise, potential data exfiltration from connected networks, and the ability to establish persistent backdoors or relay attacks. Network administrators face heightened risk of unauthorized access to internal network resources, including sensitive corporate data, user credentials, and other confidential information. The vulnerability affects not only individual consumer-grade devices but also enterprise deployments where such routers may be used as network gateways. Organizations should implement immediate mitigation strategies including firmware updates, network segmentation, and monitoring for suspicious traffic patterns that may indicate exploitation attempts. The presence of publicly available exploit codes accelerates the risk timeline, making prompt remediation essential to prevent widespread compromise across affected TOTOLINK A800R installations.