Totolink — CraftedSignal Threat Feed

Totolink WA300 Buffer Overflow Vulnerability (CVE-2026-7719)

hello@craftedsignal.io — Mon, 04 May 2026 02:15:58 +0000

A critical buffer overflow vulnerability, identified as CVE-2026-7719, has been discovered in Totolink WA300 version 5.2cu.7112_B20190227. This vulnerability resides within the loginauth function of the /cgi-bin/cstecgi.cgi file, affecting the POST Request Handler component. The vulnerability is triggered by manipulating the http_host argument in a POST request. The exploit is publicly available, increasing the risk of widespread exploitation. This vulnerability allows for remote code execution, potentially granting attackers full control over the affected device. The affected version was released in February 2019. Defenders should prioritize patching or mitigating this vulnerability to prevent potential compromise.

Attack Chain

The attacker identifies a vulnerable Totolink WA300 device running firmware version 5.2cu.7112_B20190227.
The attacker crafts a malicious HTTP POST request targeting the /cgi-bin/cstecgi.cgi endpoint.
The crafted POST request includes a specially crafted http_host argument designed to overflow the buffer in the loginauth function.
The vulnerable loginauth function processes the http_host argument without proper bounds checking.
The oversized http_host argument overwrites adjacent memory regions, including the return address on the stack.
Upon completion of the loginauth function, the overwritten return address is used, redirecting execution to attacker-controlled code.
The attacker-controlled code executes with elevated privileges, allowing the attacker to execute arbitrary commands on the device.
The attacker gains complete control of the device, potentially using it for malicious purposes such as botnet participation, data theft, or further network penetration.

Impact

Successful exploitation of CVE-2026-7719 allows a remote attacker to execute arbitrary code on the vulnerable Totolink WA300 device. This can lead to complete device compromise, allowing the attacker to steal sensitive information, use the device as a botnet node, or pivot to other devices on the network. Given the public availability of the exploit, widespread exploitation is possible, potentially affecting a large number of home and small business networks using the vulnerable device.

Recommendation

Deploy the Sigma rule Detect Totolink WA300 HTTP Host Buffer Overflow Attempt to identify exploitation attempts in web server logs.
Monitor web server logs for POST requests to /cgi-bin/cstecgi.cgi with unusually long http_host headers.
Consider deploying a web application firewall (WAF) rule to filter out malicious requests targeting CVE-2026-7719.
Upgrade to a patched version of the firmware or replace the affected device to remediate the vulnerability.

Totolink A8000RU OS Command Injection Vulnerability (CVE-2026-7240)

hello@craftedsignal.io — Tue, 28 Apr 2026 08:16:02 +0000

A critical vulnerability, CVE-2026-7240, has been identified in Totolink A8000RU router firmware version 7.1cu.643_b20200521. This flaw resides within the CGI Handler component, specifically in the setVpnAccountCfg function of the /cgi-bin/cstecgi.cgi file. By exploiting this vulnerability, a remote attacker can inject arbitrary operating system commands by manipulating the User argument. Publicly available exploit code exists, increasing the risk of widespread exploitation. This vulnerability poses a significant threat as it allows complete control of the affected device, potentially leading to network compromise and data exfiltration.

Attack Chain

The attacker identifies a Totolink A8000RU router running firmware version 7.1cu.643_b20200521 accessible via the web interface.
The attacker crafts a malicious HTTP request targeting the /cgi-bin/cstecgi.cgi endpoint.
The crafted request includes the setVpnAccountCfg function call with a payload injected into the User argument. The payload contains OS commands to be executed on the router.
The router’s CGI Handler processes the request without proper sanitization of the User argument.
The injected OS commands are executed with the privileges of the web server process.
The attacker gains remote shell access to the router.
The attacker leverages the compromised router to pivot within the network, potentially accessing sensitive data or other internal systems.
The attacker could modify the router’s configuration, intercept network traffic, or use it as a launching point for further attacks.

Impact

Successful exploitation of CVE-2026-7240 allows a remote, unauthenticated attacker to execute arbitrary commands on the affected Totolink A8000RU router. This could lead to a complete compromise of the device, potentially exposing sensitive information, enabling unauthorized network access, and facilitating further attacks within the network. Given the ease of exploitation and the availability of public exploits, organizations using this router model are at high risk of experiencing significant security breaches.

Recommendation

Deploy the Sigma rule Detect Totolink A8000RU Command Injection Attempt to identify exploitation attempts against vulnerable Totolink routers. Enable webserver logging to capture the necessary request data.
Apply the Sigma rule Detect Totolink A8000RU Malicious User Agent to detect potential exploit attempts based on modified User-Agent headers.
Monitor webserver logs for requests to /cgi-bin/cstecgi.cgi containing suspicious characters or command sequences in the cs-uri-query field, indicative of command injection attempts.
Given the public availability of exploit code, organizations using the Totolink A8000RU 7.1cu.643_b20200521 are advised to replace the device if a patch is not available from the vendor.

Totolink A3002MU Router Stack-Based Buffer Overflow Vulnerability

hello@craftedsignal.io — Tue, 14 Apr 2026 12:00:00 +0000

CVE-2026-6194 describes a stack-based buffer overflow vulnerability present in Totolink A3002MU router firmware version B20211125.1046. The vulnerability resides within the HTTP Request Handler, specifically in the sub_410188 function of the /boafrm/formWlanSetup file. A remote attacker can exploit this vulnerability by crafting a malicious HTTP request that manipulates the wan-url argument, leading to arbitrary code execution on the device. Publicly available exploit code increases the likelihood of exploitation. Successful exploitation allows an attacker to compromise the device and potentially gain control of the network.

Attack Chain

The attacker identifies a vulnerable Totolink A3002MU router running firmware B20211125.1046.
The attacker crafts a malicious HTTP POST request targeting the /boafrm/formWlanSetup endpoint.
The crafted request includes a wan-url argument with a payload exceeding the buffer size allocated for it in the sub_410188 function.
The HTTP Request Handler processes the request and calls the vulnerable sub_410188 function.
Due to insufficient bounds checking, the oversized wan-url argument overflows the stack buffer.
The attacker overwrites critical data on the stack, including the return address.
Upon returning from the sub_410188 function, execution is redirected to an attacker-controlled address.
The attacker executes arbitrary code, potentially gaining full control of the router.

Impact

Successful exploitation of CVE-2026-6194 can lead to complete compromise of the affected Totolink A3002MU router. This allows attackers to eavesdrop on network traffic, modify DNS settings, inject malicious code into web pages served to connected clients, or use the compromised router as a botnet node. Given the widespread use of these routers, a large number of devices could be at risk, potentially impacting home and small business networks.

Recommendation

Monitor web server logs for suspicious POST requests to /boafrm/formWlanSetup with unusually long wan-url parameters to detect potential exploitation attempts (see Sigma rule “Detect Suspicious WAN-URL Parameter Length”).
Deploy the Sigma rules provided in this brief to your SIEM to detect and alert on potential exploitation attempts.
If possible, block requests matching the patterns identified in the Sigma rules at your network perimeter.

TOTOLINK A7000R Stack-Based Buffer Overflow Vulnerability

hello@craftedsignal.io — Mon, 13 Apr 2026 07:16:51 +0000

A stack-based buffer overflow vulnerability, tracked as CVE-2026-6168, has been identified in TOTOLINK A7000R routers with firmware versions up to 9.1.0u.6115. The vulnerability resides within the setWiFiEasyGuestCfg function located in the /cgi-bin/cstecgi.cgi file. Successful exploitation allows a remote attacker to execute arbitrary code on the device. Publicly available exploit code exists, increasing the risk of widespread exploitation. Given the widespread use of TOTOLINK devices, this vulnerability poses a significant threat to home and small business networks. Exploitation is possible with low privileges, as it only requires authentication to the device’s web interface.

Attack Chain

Attacker authenticates to the TOTOLINK A7000R web interface. This step assumes default credentials or compromised credentials.
The attacker crafts a malicious HTTP POST request targeting the /cgi-bin/cstecgi.cgi endpoint.
The request includes the setWiFiEasyGuestCfg function call.
The ssid5g argument within the POST request is populated with a string exceeding the buffer’s capacity.
The vulnerable setWiFiEasyGuestCfg function in /cgi-bin/cstecgi.cgi processes the oversized ssid5g argument without proper bounds checking.
This leads to a stack-based buffer overflow, overwriting adjacent memory regions.
The attacker leverages the overflow to inject and execute arbitrary code on the device.
Successful code execution can grant the attacker full control of the router, enabling further malicious activities.

Impact

Successful exploitation of CVE-2026-6168 allows a remote attacker to execute arbitrary code on the vulnerable TOTOLINK A7000R device. This can lead to complete compromise of the router, including the ability to intercept network traffic, modify DNS settings, inject malicious scripts into websites, and use the router as a pivot point for further attacks within the network. This vulnerability affects potentially thousands of devices, particularly in home and small business environments.

Recommendation

Apply firmware updates immediately if TOTOLINK releases a patch for CVE-2026-6168.
Monitor web server logs for POST requests to /cgi-bin/cstecgi.cgi with unusually long ssid5g parameters, using the provided Sigma rule.
Implement network intrusion detection systems (IDS) rules to detect attempts to exploit stack-based buffer overflows targeting TOTOLINK devices.
Restrict access to the router’s web interface to trusted IP addresses, if possible.
Enforce strong and unique passwords for all router accounts.

Totolink A8000R Authentication Bypass Vulnerability (CVE-2026-5676)

hello@craftedsignal.io — Mon, 06 Apr 2026 19:16:30 +0000

CVE-2026-5676 is an authentication bypass vulnerability affecting Totolink A8000R routers with firmware version 5.9c.681_B20180413. The vulnerability resides in the /cgi-bin/cstecgi.cgi file, specifically within the setLanguageCfg function. By manipulating the langType argument, an attacker can bypass authentication checks, potentially gaining unauthorized access to sensitive router functionalities. This vulnerability can be exploited remotely without requiring any prior authentication. A public exploit is available, increasing the likelihood of exploitation. Defenders should prioritize detection and patching of this vulnerability to prevent unauthorized access and control of affected devices.

Attack Chain

An attacker identifies a vulnerable Totolink A8000R router running firmware 5.9c.681_B20180413.
The attacker sends a crafted HTTP request to /cgi-bin/cstecgi.cgi.
The request targets the setLanguageCfg function.
The request includes a manipulated langType argument designed to bypass authentication.
The vulnerable setLanguageCfg function processes the request without proper authentication checks.
The attacker gains unauthorized access to router configuration settings.
The attacker modifies sensitive settings such as DNS, routing rules, or firewall configuration.
The attacker achieves full control of the router, potentially using it for malicious purposes like eavesdropping, traffic redirection, or botnet activities.

Impact

Successful exploitation of CVE-2026-5676 allows a remote, unauthenticated attacker to gain full control of the affected Totolink A8000R router. This can lead to a variety of malicious activities, including unauthorized access to the local network, data theft, DNS hijacking, and the use of the router as part of a botnet. The potential number of affected devices is substantial, as the A8000R model is widely used.

Recommendation

Deploy the Sigma rule to detect malicious HTTP requests targeting the vulnerable setLanguageCfg function (see “Detect Totolink A8000R Authentication Bypass Attempt” rule below).
Monitor web server logs for requests to /cgi-bin/cstecgi.cgi with unusual langType parameters (see “Detect Totolink A8000R Authentication Bypass Attempt” rule below).
Upgrade the firmware of Totolink A8000R routers to a patched version that addresses CVE-2026-5676 (consult the vendor’s website for updates).
Implement network segmentation to limit the impact of a compromised router on other devices on the network.

Totolink A7100RU OS Command Injection Vulnerability (CVE-2026-5677)

hello@craftedsignal.io — Mon, 06 Apr 2026 19:16:30 +0000

A critical OS command injection vulnerability, tracked as CVE-2026-5677, has been identified in Totolink A7100RU routers running firmware version 7.4cu.2313_b20191024. The vulnerability resides within the CsteSystem function of the /cgi-bin/cstecgi.cgi file. By manipulating the resetFlags argument, a remote attacker can inject and execute arbitrary operating system commands on the affected device. This exploit is publicly available, increasing the risk of widespread exploitation. Successful exploitation allows an attacker to gain complete control over the device, potentially leading to data theft, denial of service, or use of the router as part of a botnet.

Attack Chain

The attacker identifies a vulnerable Totolink A7100RU router with firmware version 7.4cu.2313_b20191024.
The attacker sends a crafted HTTP request to the /cgi-bin/cstecgi.cgi endpoint.
The HTTP request includes the resetFlags argument with a malicious payload containing OS commands.
The CsteSystem function processes the request without proper sanitization of the resetFlags argument.
The injected OS commands are executed with the privileges of the web server process.
The attacker gains arbitrary code execution on the router’s operating system.
The attacker can then install persistent backdoors, modify router settings, or use the device for further attacks.

Impact

Successful exploitation of CVE-2026-5677 allows a remote attacker to execute arbitrary commands on vulnerable Totolink A7100RU routers. This can lead to complete compromise of the device, enabling attackers to steal sensitive information, disrupt network services, or use the router as a launchpad for other attacks, such as botnet participation or man-in-the-middle attacks. Given the widespread use of Totolink routers, a successful large-scale exploitation could affect thousands of users.

Recommendation

Deploy the Sigma rule Detect Totolink A7100RU CsteSystem Command Injection Attempt to your SIEM to identify malicious requests to the /cgi-bin/cstecgi.cgi endpoint.
Inspect web server logs for suspicious POST requests to /cgi-bin/cstecgi.cgi containing shell metacharacters in the resetFlags parameter to detect exploitation attempts (webserver logs).

Totolink A3300R Command Injection Vulnerability (CVE-2026-5176)

hello@craftedsignal.io — Tue, 31 Mar 2026 02:15:59 +0000

A command injection vulnerability, identified as CVE-2026-5176, has been discovered in Totolink A3300R routers running firmware version 17.0.0cu.557_b20221024. The vulnerability resides within the setSyslogCfg function located in the /cgi-bin/cstecgi.cgi file. An unauthenticated, remote attacker can exploit this flaw by manipulating arguments passed to the vulnerable function. This manipulation results in the execution of arbitrary commands on the affected device. Given the public…

Totolink LR350 Remote Buffer Overflow Vulnerability (CVE-2026-4976)

hello@craftedsignal.io — Fri, 27 Mar 2026 21:17:28 +0000

A critical buffer overflow vulnerability, CVE-2026-4976, has been identified in Totolink LR350 routers running firmware version 9.3.5u.6369_B20220309. The vulnerability resides in the setWiFiGuestCfg function within the /cgi-bin/cstecgi.cgi file. By crafting a malicious HTTP request and manipulating the ssid argument, a remote, unauthenticated attacker can trigger a buffer overflow, potentially leading to arbitrary code execution on the device. The availability of a public exploit…

TOTOLINK X6000R Remote Command Injection Vulnerability

hello@craftedsignal.io — Tue, 24 Mar 2026 12:00:00 +0000

A critical vulnerability, CVE-2026-4611, affects TOTOLINK X6000R routers running firmware versions 9.4.0cu.1360_B20241207 and 9.4.0cu.1498_B20250826. This vulnerability allows a remote attacker to inject operating system commands by manipulating the Hostname argument passed to the setLanCfg function within the /usr/sbin/shttpd binary. Successful exploitation grants the attacker the ability to execute arbitrary commands with elevated privileges on the router. Given the widespread deployment of these routers in home and small office networks, this vulnerability poses a significant risk of compromise, potentially leading to data theft, botnet recruitment, or denial-of-service attacks. The vulnerability was reported on March 23, 2026.

Attack Chain

Attacker identifies a vulnerable TOTOLINK X6000R router running firmware version 9.4.0cu.1360_B20241207 or 9.4.0cu.1498_B20250826.
The attacker crafts a malicious HTTP request targeting the /usr/sbin/shttpd web server.
The malicious request includes a modified Hostname argument within the setLanCfg function call.
The Hostname argument contains OS command injection payloads such as backticks, semicolons, or command chaining operators (e.g., &&, ||).
The shttpd process, running with elevated privileges, processes the malicious Hostname argument without proper sanitization.
The injected OS commands are executed by the system shell, leading to arbitrary code execution.
The attacker gains control of the router’s operating system.
The attacker can then perform a variety of malicious actions, such as exfiltrating sensitive data, modifying router configurations, or using the router as a foothold for further network attacks.

Impact

Successful exploitation of CVE-2026-4611 allows attackers to execute arbitrary commands on vulnerable TOTOLINK X6000R routers. This could lead to a complete compromise of the device, allowing attackers to steal sensitive information such as Wi-Fi passwords, intercept network traffic, or use the router as a launching point for attacks against other devices on the network. Given the potential for widespread exploitation, a large number of home and small business networks could be affected, resulting in significant financial and reputational damage.

Recommendation

Monitor web server logs (category: webserver, product: linux) for requests containing suspicious characters or command injection attempts within the Hostname argument when accessing the /usr/sbin/shttpd endpoint.
Implement the provided Sigma rule to detect exploitation attempts in web server logs.
Contact TOTOLINK for a security patch or upgrade guidance.
Consider implementing network segmentation to limit the impact of a compromised router.

Totolink A8000RU OS Command Injection Vulnerability

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

A critical vulnerability, tracked as CVE-2026-7538, has been identified in Totolink A8000RU router firmware version 7.1cu.643_b20200521. This vulnerability resides within the CGI handler component, specifically in the /cgi-bin/cstecgi.cgi file. The vulnerability arises from improper handling of the proto argument, which can be manipulated by an attacker to inject arbitrary operating system commands. Given that the attack can be initiated remotely and a public exploit is available, defenders should prioritize patching or implementing mitigations immediately. Exploitation could allow unauthenticated attackers to gain complete control over the affected device.

Attack Chain

An attacker identifies a Totolink A8000RU router with the vulnerable firmware version (7.1cu.643_b20200521) exposed to the internet.
The attacker sends a specially crafted HTTP request to the /cgi-bin/cstecgi.cgi endpoint.
The HTTP request includes a malicious payload within the proto argument. This payload is designed to execute arbitrary OS commands.
The CGI handler processes the request without proper sanitization of the proto argument.
The unsanitized input from the proto argument is passed directly to a system call, resulting in OS command injection.
The injected command executes with the privileges of the web server process.
The attacker gains the ability to execute arbitrary code on the router, potentially including downloading and executing a reverse shell.
The attacker establishes a persistent foothold and can perform further malicious activities, such as network reconnaissance, data exfiltration, or using the compromised device as part of a botnet.

Impact

Successful exploitation of CVE-2026-7538 grants attackers complete control over the affected Totolink A8000RU router. This can lead to a variety of malicious outcomes, including unauthorized access to the local network, data theft, and the use of the router as a node in a botnet for DDoS attacks or other malicious campaigns. Given the availability of a public exploit, widespread exploitation is possible if devices are not promptly patched or protected.

Recommendation

Apply available patches or firmware updates for Totolink A8000RU version 7.1cu.643_b20200521 to remediate CVE-2026-7538.
Implement network intrusion detection system (IDS) rules to detect malicious HTTP requests targeting the /cgi-bin/cstecgi.cgi endpoint with suspicious payloads in the proto argument.
Deploy the Sigma rule Detect Totolink A8000RU Command Injection Attempt to your SIEM to identify exploitation attempts based on suspicious HTTP requests.
Monitor web server logs for unusual activity or errors related to the /cgi-bin/cstecgi.cgi endpoint.