CVE-2026-19846 is a high-severity stack-based buffer overflow vulnerability affecting TOTOLINK A800R firmware version 4.1.2cu.5137_B20200730. The vulnerability resides in the setUrlFilterRules function of the /cgi-bin/cstecgi.cgi endpoint in the firewall.so component. An attacker can remotely trigger this flaw by sending crafted input to the url parameter, potentially leading to arbitrary code execution or denial of service. Exploit code is publicly available, but there is no indication of active exploitation in the wild. No patch or official remediation has been provided or linked in the available data.

Successful exploitation of this vulnerability could allow a remote attacker with low privileges to execute arbitrary code, cause denial of service, or compromise the device. The CVSS 3.1 base score of 8.8 reflects high impact on confidentiality, integrity, and availability. The presence of public exploit code increases the likelihood of exploitation attempts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict remote access to the affected device and monitor for suspicious activity related to the /cgi-bin/cstecgi.cgi endpoint. Consider network-level protections to limit exposure of the vulnerable service.