CVE-2026-19846: TOTOLINK A800R firewall.so cstecgi.cgi setUrlFilterRules stack-based overflow
A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137B20200730. This impacts the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19846?
CVE-2026-19846 has a severity rating of 8.8, indicating a high level of risk.
How do I fix CVE-2026-19846?
To mitigate CVE-2026-19846, update the TOTOLINK A800R device firmware to the latest version provided by the vendor.
Can CVE-2026-19846 be exploited remotely?
Yes, CVE-2026-19846 can be exploited remotely by manipulating the argument url in the affected component.
What component is affected by CVE-2026-19846?
CVE-2026-19846 affects the setUrlFilterRules function in the firewall.so component of the cstecgi.cgi file.
What type of vulnerability is CVE-2026-19846 classified as?
CVE-2026-19846 is classified as a buffer overflow vulnerability.