CVE-2026-79911: Stack-based Buffer Overflow in TOTOLINK N600R

CVE-2026-79911 is a stack-based buffer overflow vulnerability in the TOTOLINK N600R router firmware version 4.3.0cu.7647_B20210106. The vulnerability resides in the setSystemConfig function of the /cgi-bin/cstecgi.cgi CGI Handler, where improper handling of the Hostname argument allows remote attackers to overflow the stack. This can lead to arbitrary code execution or denial of service. The vulnerability is remotely exploitable without authentication. Public exploit code has been disclosed, increasing the risk of exploitation. No official patch or remediation level has been documented as of the publication date.

Successful exploitation of this vulnerability can allow remote attackers to execute arbitrary code on the affected device or cause a denial of service by crashing the system. Given the critical CVSS score of 10 and the availability of public exploit code, the risk to affected devices is severe. The vulnerability affects the device's core configuration interface, potentially compromising device integrity and network security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the device's management interface from untrusted networks to reduce exposure. Monitor vendor communications for updates on patches or official mitigations.