A vulnerability was determined in TOTOLINK A720R 4.1.5cu.630_B20250509. (CVE-2026-82539)

CVE-2026-82539 is a remote memory corruption vulnerability in TOTOLINK A720R firmware 4.1.5cu.630_B20250509. The issue is located in the setMacFilterRules function within the cstecgi.cgi file of the MAC Filtering component. An attacker can manipulate the 'desc' argument to trigger memory corruption remotely, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The CVSS v3.1 score is 9.1, indicating high severity. Public exploit information is available, but no known active exploitation has been confirmed. No vendor advisory or patch information is provided.

Successful exploitation of this vulnerability can lead to memory corruption, which may allow an attacker to execute arbitrary code or cause denial of service. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. This means a privileged attacker with network access could remotely exploit this flaw to fully compromise the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device and monitor for suspicious activity related to MAC filtering configuration. Avoid exposing the device's management interface to untrusted networks.