This vulnerability involves a stack-based buffer overflow triggered by manipulating the ssid5g argument in the setWiFiEasyGuestCfg function of the TOTOLINK A7000R router firmware (up to version 9.1.0u.6115). The vulnerable code resides in the /cgi-bin/cstecgi.cgi file. The flaw allows remote attackers to overflow the stack, potentially leading to arbitrary code execution or denial of service. The CVSS v4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Although an exploit is publicly available, there is no vendor-provided patch or official remediation at this time.

Successful exploitation can lead to a stack-based buffer overflow, which may allow remote attackers to execute arbitrary code or cause a denial of service on the affected device. The vulnerability can be triggered remotely without authentication or user interaction, increasing the risk of exploitation. The availability of a public exploit increases the likelihood of attacks targeting vulnerable devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the device's management interface to trusted sources only and monitor for unusual activity. Avoid exposing the device's management interface to untrusted networks. Follow updates from TOTOLINK for any forthcoming patches or mitigations.