CVE-2026-79911: Stack-based Buffer Overflow in TOTOLINK N600R

This vulnerability affects TOTOLINK N600R version 4.3.0cu.7647_B20210106. The setSystemConfig function in the CGI handler improperly handles the Hostname argument, leading to a stack-based buffer overflow (CWE-119, CWE-121). The flaw allows remote attackers to cause memory corruption, potentially leading to arbitrary code execution. The vulnerability has a CVSS 3.1 base score of 10.0, indicating critical severity. Exploit code is publicly available, but no known active exploitation in the wild has been reported. No official patch or remediation information is provided in the available data.

Successful exploitation of this vulnerability can lead to remote code execution on the affected device without any authentication or user interaction. This can compromise the device's integrity, confidentiality, and availability. Given the critical CVSS score and public exploit disclosure, affected devices are at high risk if exposed to untrusted networks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the device's management interface from untrusted networks and monitor for any suspicious activity related to the CGI handler. Avoid exposing the device's web interface to the internet.