CVE-2026-19814 is a stack-based buffer overflow vulnerability in the TOTOLINK A800R router firmware version 4.1.2cu.5137_B20200730. The flaw resides in the setMacQos function within the /cgi-bin/cstecgi.cgi file of the firewall.so component. An attacker can remotely exploit this vulnerability by sending a specially crafted macAddress argument, leading to a buffer overflow condition. This vulnerability is classified under CWE-119 and has a CVSS v3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Public exploit code is available, but there are no known exploits in the wild at this time. No patch or official remediation has been documented.

Successful exploitation of this vulnerability allows remote attackers to cause a stack-based buffer overflow, which can lead to arbitrary code execution with elevated privileges. This impacts the confidentiality, integrity, and availability of the affected device. Given the high CVSS score and public exploit availability, the risk of compromise is significant if the device is exposed to untrusted networks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device's management interface from untrusted networks to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.