CVE-2026-114382: Stack-based Buffer Overflow in TOTOLINK EX200
Description
CVE-2026-114382 is a critical stack-based buffer overflow vulnerability in TOTOLINK EX200 version 5.2.3c.7200. It occurs in the setStaticDhcpConfig function within /cgi-bin/cstecgi.cgi of the lan.so component. The flaw is triggered by manipulating the Comment argument, allowing remote attackers to exploit the vulnerability without any privileges or user interaction. Public exploit code is available, increasing the risk of attacks.
CVSS v4.0
Score 10.0critical
Affected software
TOTOLINK
EX200
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability is a stack-based buffer overflow in the setStaticDhcpConfig function of the lan.so component in TOTOLINK EX200 firmware version 5.2.3c.7200. The issue arises from improper handling of the Comment argument in the CGI script /cgi-bin/cstecgi.cgi, enabling remote attackers to execute arbitrary code or cause denial of service. The vulnerability has a CVSS 4.0 base score of 10.0, reflecting its critical severity and ease of exploitation without authentication or user interaction. Public exploit code has been released, which may facilitate attacks.
Potential Impact
Successful exploitation can lead to remote code execution or denial of service on affected devices without requiring authentication or user interaction. Given the critical CVSS score and public availability of exploit code, this vulnerability poses a severe risk to affected TOTOLINK EX200 devices running version 5.2.3c.7200.
Mitigation Recommendations
No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, affected devices should be isolated from untrusted networks to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-10-21T11:26:28.357Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad932a14d27ba8daa058c02
Added to database: 10/21/2026, 21:46:09 UTC
Last enriched: 10/21/2026, 22:00:30 UTC
Last updated: 10/21/2026, 22:01:06 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.