CVE-2026-75012
Received Received - Intake

Null Pointer Dereference in TOTOLINK EX1200L

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulDB

Description
A security vulnerability has been detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. Affected by this issue is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Password Configuration Handler. The manipulation leads to null pointer dereference. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-18
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-75012
EUVD
EUVD-2026-60360

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
totolink ex1200l 9.3.5u.6146_b20201023

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-75012 is a NULL pointer dereference vulnerability in TOTOLINK EX1200L firmware version 9.3.5u.6146_B20201023. It exists in the setPasswordCfg function of the /cgi-bin/cstecgi.cgi component. The flaw occurs when the function processes a POST request missing required password configuration fields, causing it to crash due to a NULL pointer dereference.

Detection Guidance

To detect this vulnerability, monitor for crashes in the TOTOLINK EX1200L web interface or check for POST requests to /cgi-bin/cstecgi.cgi with the topicurl set to setPasswordCfg but missing required password fields. Use network traffic analysis tools like tcpdump or Wireshark to inspect HTTP POST requests targeting this endpoint.

Impact Analysis

This vulnerability allows remote attackers to crash the web management interface of affected TOTOLINK EX1200L devices by sending a specially crafted request. The crash results in a denial of service, making the device's web interface unavailable until manually restarted.

Compliance Impact

This vulnerability causes a denial of service (DoS) in the web management interface of TOTOLINK EX1200L devices due to a NULL pointer dereference. Such disruptions could impact the availability of systems handling sensitive data, potentially violating compliance requirements for GDPR (availability of personal data) and HIPAA (access to protected health information).

Mitigation Strategies

Immediately restrict access to the web management interface of TOTOLINK EX1200L to trusted networks only. Disable remote administration if not required. Monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi and apply firmware updates from the vendor if available. Consider isolating the device from critical network segments until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75012. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart