CVE-2026-6157
Remote Buffer Overflow in Totolink A800R app.so Module
Publication date: 2026-04-13
Last updated on: 2026-04-13
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | a800r | 4.1.2cu.5137_b20200730 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-6157 is a remote stack-based buffer overflow vulnerability found in the TOTOLINK A800R router running firmware version 4.1.2cu.5137_B20200730. It occurs in the setAppEasyWizardConfig function within the /lib/cste_modules/app.so module.
The vulnerability arises because the function copies the apcliSsid parameter from HTTP requests into a fixed-size 32-byte stack buffer without checking the length of the input. This is done using the unsafe strcpy operation, which does not validate input size.
If an attacker supplies an excessively long apcliSsid string, it causes a buffer overflow that overwrites adjacent stack memory. This can lead to memory corruption, causing the process to crash (denial of service) or potentially allowing remote attackers to execute arbitrary code.
The exploit can be triggered remotely via HTTP POST requests to the /cgi-bin/cstecgi.cgi endpoint, targeting the "setting/setAppEasyWizardConfig" topic with a crafted apcliSsid parameter.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing remote attackers to cause a denial of service on your TOTOLINK A800R router, making the device crash and become unavailable.
More severely, attackers may exploit this buffer overflow to execute arbitrary code remotely on the device. This could lead to unauthorized control over the router, potentially compromising your network security.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTP POST requests sent to the /cgi-bin/cstecgi.cgi endpoint, specifically those targeting the "setting/setAppEasyWizardConfig" topic with the apcliSsid parameter.
A suspicious sign would be an unusually long apcliSsid parameter value in these POST requests, as the vulnerability arises from a buffer overflow caused by an excessively long string.
To detect exploitation attempts, you can use network monitoring tools or packet capture utilities like tcpdump or Wireshark to filter HTTP POST requests to /cgi-bin/cstecgi.cgi.
- Example tcpdump command to capture relevant traffic: tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep -i 'POST /cgi-bin/cstecgi.cgi'
- Use grep or similar tools on captured HTTP POST data to look for the "setting/setAppEasyWizardConfig" topic and check the length of the apcliSsid parameter.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable endpoint /cgi-bin/cstecgi.cgi to trusted networks or IP addresses to prevent remote exploitation.
Implement network-level filtering or firewall rules to block suspicious HTTP POST requests containing unusually long apcliSsid parameters targeting the setting/setAppEasyWizardConfig topic.
If possible, update the firmware of the TOTOLINK A800R router to a version where this vulnerability is patched.
As a temporary measure, monitor logs and network traffic for signs of exploitation attempts and consider disabling or limiting the use of the affected functionality if feasible.