This vulnerability involves a stack-based buffer overflow in the TOTOLINK A800R router firmware version 4.1.2cu.5137_B20200730. The issue is located in the setWiFiWpsConfig function of the wps.so component, accessible via the /cgi-bin/cstecgi.cgi endpoint. By sending a specially crafted 'pin' argument, an attacker can trigger a buffer overflow condition remotely. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Exploit code has been publicly released, but there is no known active exploitation in the wild. No vendor patch or official remediation is currently documented.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service on the affected device. The attacker requires no privileges or user interaction and can launch the attack over the network. The availability of public exploit code increases the likelihood of exploitation attempts. The vulnerability compromises the security and stability of the TOTOLINK A800R router running the specified firmware version.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling WPS functionality if possible or restrict network access to trusted sources to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.