This vulnerability exists in the TOTOLINK A800R router firmware version 4.1.2cu.5137_B20200730 within the setStaticDhcpConfig function of the /cgi-bin/cstecgi.cgi file, specifically in the lan.so component. A specially crafted input to the Comment argument can cause a stack-based buffer overflow, potentially allowing remote code execution or denial of service. The vulnerability is remotely exploitable without user interaction and has a high CVSS 4.0 score of 8.7. Although an exploit has been publicly disclosed, there is no official patch or remediation level provided by the vendor as of the publication date.

Successful exploitation of this vulnerability can lead to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code remotely or cause a denial of service on the affected device. Given the high CVSS score and remote exploitability, the impact is significant for affected systems running the specified firmware version.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor the vendor's communications for updates. Until a patch is available, restricting access to the affected device's management interface from untrusted networks may reduce exposure.