CVE-2026-19847: Stack-based Buffer Overflow in TOTOLINK A800R
A stack-based buffer overflow vulnerability exists in the TOTOLINK A800R router firmware version 4.1.2cu.5137_B20200730. The flaw is in the setWiFiWpsConfig function within the wps.so component, specifically in the /cgi-bin/cstecgi.cgi file. Remote attackers can exploit this by manipulating the pin argument. Public exploit code is available, increasing the risk of attacks.
AI Analysis
Technical Summary
CVE-2026-19847 is a high-severity stack-based buffer overflow vulnerability affecting TOTOLINK A800R firmware version 4.1.2cu.5137_B20200730. The vulnerability resides in the setWiFiWpsConfig function of the wps.so component, accessible via the /cgi-bin/cstecgi.cgi endpoint. By sending a specially crafted pin argument, an attacker can trigger a stack-based buffer overflow remotely. Exploit code has been publicly released, which may facilitate exploitation attempts. No official patch or remediation guidance has been provided by the vendor as of the publication date.
Potential Impact
Successful exploitation of this vulnerability can lead to arbitrary code execution on the affected device due to the stack-based buffer overflow. This may allow an attacker to compromise the router remotely without user interaction, potentially leading to device takeover or disruption of network services.
Mitigation Recommendations
No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisories for updates. Until a fix is released, consider disabling WPS functionality if possible or restricting access to the /cgi-bin/cstecgi.cgi endpoint to trusted networks only to reduce exposure.
CVE-2026-19847: Stack-based Buffer Overflow in TOTOLINK A800R
Description
A stack-based buffer overflow vulnerability exists in the TOTOLINK A800R router firmware version 4.1.2cu.5137_B20200730. The flaw is in the setWiFiWpsConfig function within the wps.so component, specifically in the /cgi-bin/cstecgi.cgi file. Remote attackers can exploit this by manipulating the pin argument. Public exploit code is available, increasing the risk of attacks.
CVSS v4.0
Score 8.7high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-19847 is a high-severity stack-based buffer overflow vulnerability affecting TOTOLINK A800R firmware version 4.1.2cu.5137_B20200730. The vulnerability resides in the setWiFiWpsConfig function of the wps.so component, accessible via the /cgi-bin/cstecgi.cgi endpoint. By sending a specially crafted pin argument, an attacker can trigger a stack-based buffer overflow remotely. Exploit code has been publicly released, which may facilitate exploitation attempts. No official patch or remediation guidance has been provided by the vendor as of the publication date.
Potential Impact
Successful exploitation of this vulnerability can lead to arbitrary code execution on the affected device due to the stack-based buffer overflow. This may allow an attacker to compromise the router remotely without user interaction, potentially leading to device takeover or disruption of network services.
Mitigation Recommendations
No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisories for updates. Until a fix is released, consider disabling WPS functionality if possible or restricting access to the /cgi-bin/cstecgi.cgi endpoint to trusted networks only to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-08-14T08:04:41.961Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7f56e0bf8831d5397df777
Added to database: 08/14/2026, 17:56:48 UTC
Last enriched: 08/14/2026, 18:11:09 UTC
Last updated: 08/14/2026, 23:51:18 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.