This vulnerability affects TOTOLINK A800R firmware version 4.1.2cu.5137_B20200730. The issue is a stack-based buffer overflow in the setRadvdCfg function of the /cgi-bin/cstecgi.cgi CGI script, specifically in the ipv6.so component. By sending a crafted request manipulating the radvdinterfacename parameter, a remote attacker can cause a buffer overflow, potentially leading to arbitrary code execution or denial of service. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity. Public exploit code is available, but no reports of active exploitation have been confirmed. No official patch or remediation guidance is currently documented.

Successful exploitation of this vulnerability could allow a remote attacker with low privileges to cause a stack-based buffer overflow, potentially leading to arbitrary code execution or denial of service on the affected device. Given the remote attack vector and high CVSS score, the impact is significant for affected devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the affected device's management interfaces from untrusted networks to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.