CVE-2026-114383

Summary

A stack-based buffer overflow in the setWiFiAclAddConfig function of wireless.so on TOTOLINK EX200 v5.2.3c.7200 allows unauthenticated remote attackers to overwrite memory via the macAddress parameter in /cgi-bin/cstecgi.cgi, potentially leading to arbitrary code execution.

Exploitability

The exploit is publicly available and requires no authentication or user interaction; exploitation is trivial for remote attackers.

Blast radius

Successful exploitation could allow full compromise of the device (remote code execution), enabling attackers to take control of the router, intercept traffic, or pivot into the internal network.

Detection

Look for HTTP POST requests to /cgi-bin/cstecgi.cgi with abnormally long macAddress values (e.g., >64 characters) in web server or application logs; unexpected restarts of the wireless.so process may also be observable in system logs.

Prioritized remediation

Upgrade to firmware version 5.2.3c.7201 or later, if available; until then, disable wireless functionality or isolate the device from untrusted networks.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.