{"id":"CVE-2026-114383","published":"2026-10-21T22:16:49.077","lastModified":"2026-10-22T15:15:23.833","description":"A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. This manipulation of the argument macAddress causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-119","CWE-121"],"vendors":[],"products":[],"references":[{"url":"https://github.com/qwq-nm/CVE/blob/f5d61361eb7d846479f6d76c0aa4273e9af46d27/CVE2/report.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-114383","tags":[]},{"url":"https://vuldb.com/submit/1019883","tags":[]},{"url":"https://vuldb.com/vuln/424742","tags":[]},{"url":"https://vuldb.com/vuln/424742/cti","tags":[]},{"url":"https://www.totolink.net/","tags":[]}],"exploitRefs":[{"url":"https://github.com/qwq-nm/CVE/blob/f5d61361eb7d846479f6d76c0aa4273e9af46d27/CVE2/report.md","tags":[]}],"hasPoc":true,"ai":{"summary":"A stack-based buffer overflow in the setWiFiAclAddConfig function of wireless.so on TOTOLINK EX200 v5.2.3c.7200 allows unauthenticated remote attackers to overwrite memory via the macAddress parameter in /cgi-bin/cstecgi.cgi, potentially leading to arbitrary code execution.","exploitability":"The exploit is publicly available and requires no authentication or user interaction; exploitation is trivial for remote attackers.","blast_radius":"Successful exploitation could allow full compromise of the device (remote code execution), enabling attackers to take control of the router, intercept traffic, or pivot into the internal network.","remediation":"Upgrade to firmware version 5.2.3c.7201 or later, if available; until then, disable wireless functionality or isolate the device from untrusted networks.","detection":"Look for HTTP POST requests to /cgi-bin/cstecgi.cgi with abnormally long macAddress values (e.g., >64 characters) in web server or application logs; unexpected restarts of the wireless.so process may also be observable in system logs.","tags":["stack-overflow","rce","iot","firmware","unauthenticated","public-exploit"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:46:21.636Z"}}