CVE-2026-85031: Buffer Overflow in TOTOLINK CP450

The vulnerability CVE-2026-85031 affects TOTOLINK CP450 firmware version 4.1.0. It is a buffer overflow triggered by manipulating the topicurl argument in an unknown function within the /cgi-bin/cstecgi.cgi CGI script. This flaw can be exploited remotely without authentication or user interaction, leading to high impact including potential code execution or service disruption. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction needed, and high impact on confidentiality, integrity, availability, and security requirements. No vendor advisory or patch information is currently available.

Successful exploitation of this buffer overflow vulnerability can lead to remote code execution or denial of service on affected TOTOLINK CP450 devices running version 4.1.0. The attacker requires no privileges or user interaction, making it highly exploitable over the network. The impact affects confidentiality, integrity, availability, and security controls of the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected device's management interfaces and monitor for unusual activity related to the /cgi-bin/cstecgi.cgi endpoint. Avoid exposing the device to untrusted networks.