CVE-2026-85031
Received Received - Intake

Buffer Overflow in TOTOLINK CP450 Firmware

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulDB

Description
A vulnerability was found in TOTOLINK CP450 4.1.0. The impacted element is an unknown function of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument topicurl results in buffer overflow. Remote exploitation of the attack is possible.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85031
EUVD
EUVD-2026-70313

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
totolink cp450 4.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-120 The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a buffer overflow in TOTOLINK CP450 version 4.1.0. It occurs in the /cgi-bin/cstecgi.cgi file when the topicurl argument is manipulated. This flaw allows remote attackers to execute arbitrary code or cause a denial of service by sending specially crafted input.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable TOTOLINK CP450 devices with firmware 4.1.0. Inspect network traffic for unusual requests to /cgi-bin/cstecgi.cgi with manipulated topicurl arguments. Use tools like Nmap to scan for devices with open ports and verify firmware versions.

Impact Analysis

The vulnerability can lead to unauthorized remote access, data breaches, or system crashes. Attackers could exploit it to take control of the device, steal sensitive information, or disrupt network operations. Users of affected TOTOLINK CP450 devices should apply patches immediately.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if exploited, as it may result in unauthorized access to personal or health data. Organizations using affected devices must address it to maintain regulatory compliance and avoid potential fines.

Mitigation Strategies

Immediately update the TOTOLINK CP450 firmware to the latest version. If no update is available, isolate the device from the network. Disable remote access to the web interface and monitor for suspicious activity targeting /cgi-bin/cstecgi.cgi.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85031. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart