Totolink EX1200L 9.3.5u.6146_B20201023 cgi-bin/cstecgi.cgi login stack-based overflow

Summaryinfo

A vulnerability was found in Totolink EX1200L 9.3.5u.6146_B20201023. It has been declared as critical. This issue affects the function Login of the file cgi-bin/cstecgi.cgi. The manipulation results in stack-based overflow. This vulnerability is reported as CVE-2026-44089. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Totolink EX1200L 9.3.5u.6146_B20201023. Affected is the function login of the file cgi-bin/cstecgi.cgi. The manipulation with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Totolink EX1200L router is vulnerable to Buffer Overflow in the login functionality in cgi-bin/cstecgi.cgi endpoint. This vulnerability could be exploited to cause the program to crash and to execute code remotely. This allows the attacker to perform actions as root including reading and editing data, as well as bricking the router. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 9.3.5u.6146_B20201023 but may also affect other versions.

The weakness was disclosed by Franciszek Malek. The advisory is available at cert.pl. This vulnerability is traded as CVE-2026-44089 since 05/05/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 06/23/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-38425). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Totolink

Name

• EX1200L

Version

• 9.3.5u.6146_B20201023

License

• commercial

Website

• Vendor: https://www.totolink.net/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion