CVE-2026-82616
Received Received - Intake

Stack-Based Buffer Overflow in TOTOLINK NR1800X Router

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description
A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82616
EUVD
EUVD-2026-68353

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
totolink nr1800x 9.1.0u.6681_b20230703

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack-based buffer overflow in the TOTOLINK NR1800X router firmware version 9.1.0u.6681_B20230703. It exists in the setUploadSetting function of the /cgi-bin/cstecgi.cgi file. The flaw is triggered by manipulating the FileName argument, which can lead to arbitrary code execution. The attack can be performed remotely without authentication.

Detection Guidance

Detecting this vulnerability requires checking for exposed instances of TOTOLINK NR1800X firmware versions vulnerable to stack-based buffer overflow via the FileName parameter in /cgi-bin/cstecgi.cgi. Use network scanning tools like Nmap to identify devices with open ports (e.g., port 80 for HTTP). Inspect web server logs for unusual requests to /cgi-bin/cstecgi.cgi with FileName parameters exceeding expected length. Exploit attempts may include long strings or malformed inputs.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary code on the affected router. This could lead to complete device compromise, allowing attackers to intercept network traffic, install malware, or use the device as part of a botnet. Users may experience loss of internet connectivity or unauthorized access to their network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data transmitted through or stored on the router. For organizations handling personal or health data, this may result in violations of GDPR or HIPAA due to potential data breaches. Compliance could be compromised if the router is used in environments subject to these regulations.

Mitigation Strategies

Immediately update the TOTOLINK NR1800X firmware to the latest version from the vendor. If no patch is available, isolate the device from the internet by disabling remote access or placing it behind a firewall. Monitor network traffic for suspicious activity targeting /cgi-bin/cstecgi.cgi. Disable CGI scripts if not required. Contact TOTOLINK support for mitigation guidance.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82616. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart