TOTOLINK EX200: Stack-based buffer overflow in setStaticDhcpConfig (CVE-2026-114382)
A security flaw in TOTOLINK EX200 firmware 5.2.3c.7200 allows for remote stack-based buffer overflow via the Comment argument in the setStaticDhcpConfig function.
CVE search metadata
CVE search record: CVE-2026-114382. Severity: critical. CVSS: 10.0. KEV: no. Product: TOTOLINK EX200 (5.2.3c.7200). Brief: TOTOLINK EX200: Stack-based buffer overflow in setStaticDhcpConfig (CVE-2026-114382). Brief link: https://feed.craftedsignal.io/briefs/2026-10-totolink-ex200-rce/
Triage facts
Revision 1- Applicability
- TOTOLINK EX200 (5.2.3c.7200)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Oct 22, 01:51 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A security flaw has been identified in TOTOLINK EX200 version 5.2.3c.7200. The vulnerability exists within the 'setStaticDhcpConfig' function of the '/cgi-bin/cstecgi.cgi' file in the 'lan.so' component. Manipulating the 'Comment' argument triggers a stack-based buffer overflow. The attack can be launched remotely, and a public exploit is available.