CVE-2026-114383 Overview
CVE-2026-114383 is a stack-based buffer overflow in the TOTOLINK EX200 wireless range extender running firmware version 5.2.3c.7200. The flaw resides in the setWiFiAclAddConfig function within /cgi-bin/cstecgi.cgi, part of the wireless.so component. Attackers manipulate the macAddress argument to overflow a stack buffer. The weakness is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). Exploitation requires no authentication and can be triggered remotely over the network. Public exploit details have been disclosed, increasing the risk of opportunistic attacks against exposed devices.
Critical Impact
Unauthenticated remote attackers can corrupt stack memory on affected TOTOLINK EX200 devices, potentially leading to arbitrary code execution or device compromise.
Affected Products
- TOTOLINK EX200 wireless range extender, firmware 5.2.3c.7200
- Component: wireless.so shared library
- Endpoint: /cgi-bin/cstecgi.cgi, function setWiFiAclAddConfig
Discovery Timeline
- 2026-10-21 - CVE-2026-114383 published to NVD
- 2026-10-22 - Last updated in NVD database
Technical Details for CVE-2026-114383
Vulnerability Analysis
The TOTOLINK EX200 exposes a CGI handler at /cgi-bin/cstecgi.cgi that dispatches requests to functions implemented in wireless.so. The setWiFiAclAddConfig function processes the macAddress parameter supplied by the client. The function copies the attacker-controlled value into a fixed-size stack buffer without validating the input length. Supplying an overlong macAddress string overwrites adjacent stack memory, including saved return addresses and function pointers. On MIPS-based consumer routers like the EX200, this condition commonly enables control-flow hijacking through techniques such as return-oriented programming. Public proof-of-concept material referenced in the GitHub CVE Report and VulDB CVE Details describes the triggering request structure.
Root Cause
The root cause is missing length validation on the macAddress argument before it is written into a stack-allocated buffer. The handler assumes a fixed MAC address format but does not enforce it. This category of defect is tracked as [CWE-119].
Attack Vector
An unauthenticated attacker sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi targeting the setWiFiAclAddConfig operation. The request includes an oversized macAddress value that exceeds the buffer boundary. Because the device typically binds the management interface to the LAN and, in some deployments, to the WAN, attackers on adjacent networks or the internet can reach the endpoint. The EPSS score is 0.653% with a 50.664 percentile ranking at the time of publication.
No verified exploit code is reproduced here. See the VulDB Vulnerability Record and the GitHub CVE Report for public technical details.
Detection Methods for CVE-2026-114383
Indicators of Compromise
- HTTP POST requests to /cgi-bin/cstecgi.cgi containing a setWiFiAclAddConfig action with a macAddress value longer than 17 characters.
- Device reboots, watchdog resets, or httpd crashes on EX200 units correlated with inbound management-plane traffic.
- Unexpected outbound connections from the EX200 to unknown hosts following access to the CGI endpoint.
Detection Strategies
- Deploy network intrusion detection rules that inspect requests to cstecgi.cgi and flag macAddress parameters that violate the standard MAC address format or exceed expected length.
- Capture and review web server logs on the device, where available, for abnormal request bodies targeting setWiFiAclAddConfig.
- Correlate firmware version 5.2.3c.7200 inventory data with exposure of the HTTP management interface to untrusted networks.
Monitoring Recommendations
- Monitor for repeated malformed requests to the /cgi-bin/cstecgi.cgi endpoint from external or guest network segments.
- Alert on process crashes or memory faults on managed network devices through SNMP traps or syslog forwarding.
- Track changes to DNS, routing, and firewall rules on EX200 devices that could indicate post-exploitation configuration tampering.
How to Mitigate CVE-2026-114383
Immediate Actions Required
- Restrict access to the EX200 web management interface to trusted administrative networks using upstream firewall or ACL rules.
- Disable remote WAN-side management on affected devices until a vendor patch is applied.
- Inventory all TOTOLINK EX200 units running 5.2.3c.7200 and prioritize those exposed to untrusted networks.
- Monitor the Totolink Official Website for firmware updates addressing CVE-2026-114383.
Patch Information
No vendor patch is referenced in the current advisory data. Administrators should track the VulDB Vulnerability Record and the vendor site for firmware updates. Where no patched firmware is available, consider replacing exposed EX200 devices with supported hardware.
Workarounds
- Place the EX200 behind a boundary firewall and block inbound TCP connections to the device management port from untrusted sources.
- Segment the EX200 onto a dedicated management VLAN with no direct internet exposure.
- Change default administrator credentials and disable any unused services, including UPnP and remote management, to reduce the attack surface.
- If the device cannot be isolated, decommission it and migrate to vendor-supported hardware with current firmware.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
