Remote Stack-based Buffer Overflow in TOTOLINK A800R

A critical security vulnerability has been identified in the TOTOLINK A800R router, specifically affecting firmware version 4.1.2cu.5137_B20200730. The flaw resides within the firewall.so component, specifically in the setIpQosRules function invoked by the /cgi-bin/cstecgi.cgi script. An attacker can exploit this via a stack-based buffer overflow by manipulating the 'Comment' argument. The vulnerability is remotely exploitable by an authenticated user and has been assigned CVE-2026-19811. Public exploit code is currently available, increasing the risk of active exploitation against vulnerable network devices. Given the nature of the device as an edge gateway, successful exploitation could provide an attacker with persistent access to the network.

Attack Chain

1. Attacker performs reconnaissance to identify the target web management interface on a publicly accessible TOTOLINK A800R router.
2. Attacker gains valid credentials for the administrative or user portal through credential stuffing or brute-forcing.
3. Attacker accesses the Quality of Service (QoS) settings page which invokes the /cgi-bin/cstecgi.cgi CGI script.
4. Attacker crafts a malicious HTTP POST request targeting the setIpQosRules function.
5. Attacker injects a specially crafted, oversized string into the 'Comment' parameter of the HTTP request.
6. The firewall.so component fails to properly validate the input size, resulting in a stack-based buffer overflow.
7. The overflow overwrites the return address on the stack, diverting program execution to attacker-controlled shellcode.
8. Attacker gains execution context, potentially leading to full system compromise or persistence on the device.

Impact

Successful exploitation allows an authenticated remote attacker to achieve arbitrary code execution on the TOTOLINK A800R device. This compromises the integrity and confidentiality of traffic passing through the router, facilitates lateral movement into the local network, and provides a platform for further exploitation of connected internal systems.

Recommendation

• Monitor web server logs for anomalies targeting /cgi-bin/cstecgi.cgi and specifically unusual values or excessive lengths in the 'Comment' parameter.
• Disable remote management access for the router's web interface, restricting access to trusted local IP addresses only.
• Evaluate the need for the device's current firmware version and apply vendor security updates if a patch addressing CVE-2026-19811 is available from TOTOLINK.
• Audit access logs for any unauthorized authentication attempts or patterns consistent with credential exploitation.