CVE-2026-75013: TOTOLINK EX1200L RCE Vulnerability

CVE-2026-75013 Overview

CVE-2026-75013 is a null pointer dereference vulnerability affecting TOTOLINK EX1200L firmware version 9.3.5u.6146_B20201023. The flaw resides in the setWizardCfg function within /cgi-bin/cstecgi.cgi, a Common Gateway Interface handler on the device. An authenticated attacker can send crafted input over the network to trigger the dereference, causing the process to crash. Public exploit code has been released, increasing the likelihood of opportunistic attempts against exposed devices. The weakness is classified under CWE-404 (Improper Resource Shutdown or Release).

Critical Impact
Remote attackers with low privileges can crash the router management interface, disrupting network availability for connected clients.

Affected Products

TOTOLINK EX1200L range extender
Firmware version 9.3.5u.6146_B20201023
CGI handler /cgi-bin/cstecgi.cgi (function setWizardCfg)

Discovery Timeline

2026-08-17 - CVE-2026-75013 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75013

Vulnerability Analysis

The TOTOLINK EX1200L exposes a web management interface backed by the cstecgi.cgi binary. This CGI dispatches requests to internal handler functions based on JSON parameters. The setWizardCfg handler processes setup wizard configuration data submitted by clients.

When the function receives a request that omits an expected field or supplies an unexpected structure, an internal pointer is not initialized before use. Dereferencing that pointer causes an immediate segmentation fault in the CGI process. The router web daemon terminates, preventing legitimate administration and often disrupting associated services on the device.

Because the failure occurs during request parsing, no complex payload is required. A short HTTP POST containing a malformed body is sufficient to reach the vulnerable code path.

Root Cause

The root cause is missing validation of pointer returns and input fields inside setWizardCfg. The handler assumes that upstream parsing routines produce a valid object reference for every configuration key. When parsing returns NULL for a missing key, the code proceeds to read from that address, triggering the crash. This pattern matches CWE-404 where a resource is not properly guarded prior to use.

Attack Vector

Exploitation requires network reachability to the device management interface and a low-privilege authenticated session, according to the CVSS 4.0 vector metadata (PR:L). The attacker sends a crafted POST request to /cgi-bin/cstecgi.cgi targeting the setWizardCfg endpoint. The malformed body triggers the null dereference and terminates the CGI worker, producing a denial-of-service condition against router administration and dependent services. The impact is limited to availability; the vector reports no confidentiality or integrity effects.

A public proof-of-concept describing the request format is hosted at the GitHub Gist PoC Repository.

Detection Methods for CVE-2026-75013

Indicators of Compromise

Repeated HTTP POST requests to /cgi-bin/cstecgi.cgi referencing the setWizardCfg topicurl parameter
Unexpected restarts or crash logs from the cstecgi process on TOTOLINK EX1200L devices
Loss of web administration availability shortly after inbound requests from untrusted sources

Detection Strategies

Inspect router syslog output for CGI worker termination messages and correlate with recent inbound management-interface requests
Deploy network intrusion detection signatures that flag POST requests targeting cstecgi.cgi with malformed or absent wizard configuration fields
Alert on any exposure of the EX1200L management interface to untrusted network segments or the public internet

Monitoring Recommendations

Forward router logs to a centralized logging platform and build detections for repeated CGI crash events
Baseline expected administrative traffic sources and flag deviations targeting /cgi-bin/cstecgi.cgi
Track availability of the management interface with synthetic checks to detect denial-of-service conditions quickly

How to Mitigate CVE-2026-75013

Immediate Actions Required

Restrict access to the EX1200L management interface to trusted management VLANs or specific administrator IP addresses
Disable remote (WAN-side) administration on affected devices
Rotate administrative credentials and enforce strong passwords to limit the pool of attackers who satisfy the PR:L precondition
Monitor the TOTOLINK Official Website for firmware updates addressing setWizardCfg

Patch Information

At the time of publication no vendor patch has been referenced in the VulDB CVE-2026-75013 entry. Administrators should track the TOTOLINK Official Website for a firmware release that supersedes 9.3.5u.6146_B20201023 and validates input inside the setup wizard handler.

Workarounds

Place the device behind a network firewall that blocks inbound access to TCP ports serving the management interface
Segment IoT and consumer network equipment away from production and sensitive user networks
Consider replacing end-of-support devices where firmware updates are unlikely to be issued

bash

# Example: block external access to the router management interface on an upstream firewall
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP