CVE-2026-19846 in A800R
Summary
by MITRE • 08/14/2026
A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability in TOTOLINK A800R router firmware version 412cu5137B20200730 represents a critical stack-based buffer overflow flaw within the firewall.so component. This issue manifests specifically in the setUrlFilterRules function of the /cgi-bin/cstecgi.cgi interface, where improper input validation allows attackers to manipulate the url argument parameter. The vulnerability exists due to insufficient bounds checking when processing user-supplied data, creating an exploitable condition that can be triggered through remote network access.
The technical implementation of this flaw stems from a classic buffer overflow vulnerability classified as CWE-121, where the application fails to properly validate the length of input data before copying it into a fixed-size stack buffer. When an attacker provides an excessively long url argument value, the function exceeds the allocated memory space, potentially overwriting adjacent stack variables, return addresses, and other critical program state information. This type of vulnerability is particularly dangerous because it can be exploited without requiring authentication or physical access to the device.
The operational impact of this vulnerability extends beyond simple denial-of-service conditions, as remote exploitation could enable full system compromise through code execution attacks. Attackers can leverage publicly available exploits to gain unauthorized access to the router's administrative interface, potentially leading to complete network takeover, data exfiltration, or use as a pivot point for attacking other devices within the local network. The vulnerability affects all users running the specified firmware version and poses significant risk to enterprise and residential networks alike.
Security mitigations should begin with immediate firmware updates from TOTOLINK to address the buffer overflow condition in the firewall.so component. Network administrators should implement strict access controls limiting remote administrative access to the device, while also deploying network segmentation to contain potential exploitation impacts. Additional protective measures include monitoring for unusual traffic patterns in the /cgi-bin/cstecgi.cgi interface and implementing intrusion detection systems that can identify exploitation attempts targeting this specific vulnerability. Organizations should also consider disabling unnecessary web services and applying network-level firewall rules to restrict access to the affected router interfaces, following ATT&CK framework techniques related to credential access and privilege escalation through remote service exploitation.