CVE-2026-75012: TOTOLINK EX1200L DoS Vulnerability

CVE-2026-75012 Overview

CVE-2026-75012 is a null pointer dereference vulnerability in the TOTOLINK EX1200L range extender running firmware version 9.3.5u.6146_B20201023. The flaw exists in the setPasswordCfg function of the /cgi-bin/cstecgi.cgi binary, which serves as the Password Configuration Handler. Attackers can trigger the condition remotely over the network with low-privileged access. The manipulation causes the affected process to dereference a null pointer, resulting in a denial-of-service condition on the device. A public proof-of-concept has been disclosed, increasing the likelihood of opportunistic exploitation against exposed devices.

Critical Impact
Remote attackers with low privileges can crash the password configuration service on TOTOLINK EX1200L devices, disrupting management functions and availability.

Affected Products

TOTOLINK EX1200L firmware 9.3.5u.6146_B20201023
Component: Password Configuration Handler within /cgi-bin/cstecgi.cgi
Function: setPasswordCfg

Discovery Timeline

2026-08-17 - CVE-2026-75012 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75012

Vulnerability Analysis

The vulnerability resides in the setPasswordCfg handler exposed through the CGI binary /cgi-bin/cstecgi.cgi. This handler processes HTTP requests submitted to the device management interface for updating password configuration. When the handler receives crafted input, it fails to validate a pointer before dereferencing it, producing a null pointer dereference classified under [CWE-404] Improper Resource Shutdown or Release.

Successful exploitation crashes the CGI process responsible for handling configuration requests. Because cstecgi.cgi centralizes many management functions on TOTOLINK devices, the crash affects availability of the administrative interface and related services. The attack does not yield code execution or data disclosure but degrades operational availability.

Root Cause

The root cause is missing input validation and pointer checking within the setPasswordCfg routine. The function accepts request parameters and passes them to internal logic without confirming that required fields resolve to valid memory. When an expected string or structure pointer is absent, the code path dereferences the null value and terminates the process.

Attack Vector

Exploitation requires network reachability to the device's HTTP management interface and low-privileged authenticated access. An attacker submits a crafted POST request to /cgi-bin/cstecgi.cgi targeting the setPasswordCfg action with parameters that induce the null dereference. Details of the request structure are documented in the public proof-of-concept.

See the GitHub Gist PoC and the VulDB entry for CVE-2026-75012 for reference material.

Detection Methods for CVE-2026-75012

Indicators of Compromise

Unexpected termination or restart of the cstecgi.cgi process on TOTOLINK EX1200L devices
HTTP POST requests to /cgi-bin/cstecgi.cgi referencing the setPasswordCfg action from unauthorized source addresses
Loss of responsiveness on the device management interface following configuration requests

Detection Strategies

Inspect web server and CGI logs for anomalous requests targeting setPasswordCfg with malformed or missing parameters
Monitor device health telemetry and syslog exports for repeated crashes of management daemons
Correlate authentication events with subsequent configuration endpoint access to identify low-privileged accounts abusing the handler

Monitoring Recommendations

Forward TOTOLINK syslog output to a centralized logging platform for retention and analysis
Alert on repeated HTTP 5xx responses or connection resets from the management interface
Track administrative account activity for unusual request patterns against /cgi-bin/cstecgi.cgi

How to Mitigate CVE-2026-75012

Immediate Actions Required

Restrict access to the device management interface to trusted management VLANs or specific administrative hosts
Disable remote WAN-side administration on affected TOTOLINK EX1200L units
Rotate credentials for any low-privileged accounts on the device and enforce strong passwords
Audit exposed devices using network scanning to identify EX1200L units reachable from untrusted networks

Patch Information

No vendor patch has been referenced in the available CVE data. Consult the TOTOLINK official website for firmware updates and advisories related to the EX1200L platform.

Workarounds

Place the device behind a firewall that blocks inbound access to the HTTP management interface from untrusted networks
Limit administrative account distribution and remove unused low-privileged accounts that could be abused to reach setPasswordCfg
Consider replacing end-of-support hardware if the vendor does not issue a firmware update addressing the null pointer dereference

bash

# Example: restrict management access to a trusted subnet using an upstream firewall
iptables -A FORWARD -p tcp -d <EX1200L_IP> --dport 80 -s 10.10.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d <EX1200L_IP> --dport 80 -j DROP