CVE-2026-114382: TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow
A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. The manipulation of the argument Comment results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Devices identified as TOTOLINK EX200 running version 5.2.3c.7200 are affected. The vulnerable functionality is reachable remotely through the device's cstecgi.cgi endpoint.
What does an attacker need to exploit it?
The attack can be launched remotely by manipulating the Comment argument processed by setStaticDhcpConfig. No privileges or user interaction are indicated in the supplied severity vector.
Is public exploit code available?
Yes. The available information states that an exploit has been released publicly and may be used in attacks.