| Title | TOTOLINK EX200 V5.2.3c.7200 Stack-based Buffer Overflow |
|---|
| Description | A stack-based buffer overflow (CWE-121) exists in the wireless.so handler of the TOTOLINK EX200 range extender (firmware V5.2.3c.7200): the setWiFiAclAddConfig function, reachable unauthenticated via POST /cgi-bin/cstecgi.cgi with topicurl=setting/setWiFiAclAddConfig, reads the user-controlled macAddress parameter with websGetVar() and appends each colon-separated token into the fixed-size stack buffer "dest" using strcat() in a loop without any length validation, so an overlong value overflows the buffer and overwrites the stack frame; the unsafe copy is reached when addEffect is 0. Because the handler runs with root privileges and no authentication or user interaction is required, an attacker with network access to the device web interface can crash the wireless service (observed as an HTTP 500 Internal Server Error) and render the device unreachable, causing a denial of service while the stack overwrite also exposes a potential path to arbitrary code execution; the issue was verified on firmware V5.2.3c.7200, with full technical details, decompiled code and PoC screenshots provided in the public advisory linked below. |
|---|
| Source | ⚠️ https://github.com/qwq-nm/CVE/blob/f5d61361eb7d846479f6d76c0aa4273e9af46d27/CVE2/report.md |
|---|
| User | zeroxf (UID 101992) |
|---|
| Submission | 10/08/2026 13:18 (24 days ago) |
|---|
| Moderation | 10/21/2026 13:26 (13 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 424742 [TOTOLINK EX200 5.2.3c.7200 wireless.so /cgi-bin/cstecgi.cgi setWiFiAclAddConfig macAddress stack-based overflow] |
|---|
| Points | 20 |
|---|