This vulnerability affects TOTOLINK A800R firmware version 4.1.2cu.5137_B20200730. The issue is a stack-based buffer overflow in the setParentalRules function of the /cgi-bin/cstecgi.cgi script, part of the firewall.so component. An attacker can remotely trigger the overflow by sending a crafted urlKeyword argument, which may lead to arbitrary code execution or denial of service. The vulnerability has a CVSS 4.0 score of 8.7 (high severity) with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Exploit code is publicly available, increasing the risk of exploitation. However, no vendor advisory or patch information is currently available.

Successful exploitation can result in a stack-based buffer overflow, potentially allowing remote code execution or causing a denial of service on the affected device. Given the remote attack vector and the availability of exploit code, this vulnerability poses a significant risk to affected devices running the specified firmware version.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, especially restricting access to the /cgi-bin/cstecgi.cgi endpoint. Monitor vendor communications for updates and apply patches promptly once available.