| Title | TOTOLINK EX200 V5.2.3c.7200 Stack-based Buffer Overflow |
|---|
| Description | A stack-based buffer overflow (CWE-121) exists in the lan.so handler of the TOTOLINK EX200 range extender (firmware V5.2.3c.7200): the setStaticDhcpConfig function, reachable unauthenticated via POST /cgi-bin/cstecgi.cgi with topicurl=setting/setStaticDhcpConfig, reads the user-controlled comment parameter with websGetVar() and copies it into the local stack buffer "v17" using strcpy() without any length validation, so an overlong value overflows the buffer and overwrites the stack frame; the unsafe copy is reached when addEffect is 0. Because the handler runs with root privileges and no authentication or user interaction is required, an attacker with network access to the device web interface can crash the service (observed as an HTTP 500 Internal Server Error) and render the device unreachable, causing a denial of service while the stack overwrite also exposes a potential path to arbitrary code execution; the issue was verified on firmware V5.2.3c.7200, with full technical details, decompiled code and PoC screenshots provided in the public advisory linked below.
|
|---|
| Source | ⚠️ https://github.com/qwq-nm/CVE/blob/f5d61361eb7d846479f6d76c0aa4273e9af46d27/CVE1/report.md |
|---|
| User | zeroxf (UID 101992) |
|---|
| Submission | 10/08/2026 13:14 (24 days ago) |
|---|
| Moderation | 10/21/2026 13:26 (13 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 424741 [TOTOLINK EX200 5.2.3c.7200 lan.so /cgi-bin/cstecgi.cgi setStaticDhcpConfig comment stack-based overflow] |
|---|
| Points | 20 |
|---|