CVE-2026-19845 is a stack-based buffer overflow vulnerability in TOTOLINK A800R firmware version 4.1.2cu.5137_B20200730. It affects the setStaticDhcpConfig function within the /cgi-bin/cstecgi.cgi component (lan.so). An attacker can remotely exploit this vulnerability by manipulating the Comment argument, potentially leading to arbitrary code execution or denial of service. The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and high impact on confidentiality, integrity, and availability. The exploit has been publicly disclosed, but no known exploits in the wild have been reported. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service due to a stack-based buffer overflow. The attacker can fully compromise the affected device's confidentiality, integrity, and availability. The vulnerability requires low privileges but no user interaction and can be triggered remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict network access to the affected device's management interface to trusted sources only and monitor for any suspicious activity related to the /cgi-bin/cstecgi.cgi endpoint.