TOTOLINK EX200: Stack-based buffer overflow in web management interface
Summary
A stack-based buffer overflow in the setStaticDhcpConfig function of the lan.so component of the TOTOLINK EX200 range extender (firmware 5.2.3c.7200) allows unauthenticated remote attackers to send an overlong comment value to /cgi-bin/cstecgi.cgi. This can crash the web management service and may allow code execution with elevated privileges. Public exploit material exists, and no vendor fix has been identified.
Affected
- TOTOLINK EX200, firmware 5.2.3c.7200
- Other firmware versions: Unknown.
Fixed in
Unknown. No vendor patch or advisory has been identified.
Workaround
- Isolate the device from untrusted networks.
- Restrict access to the management interface to trusted hosts only.
- Disable remote management from the internet.
Exploitation
- Public proof-of-concept exploit material exists.
- Not listed as known exploited; no evidence of exploitation in the wild has been found.
- No authentication or user interaction is required.
Our recommendation
- Inventory all TOTOLINK EX200 devices and check whether their management interface is reachable from untrusted networks.
- Remove any internet exposure immediately.
- Plan replacement with a supported model, as no fix has been published.
- Monitor for unusual requests to /cgi-bin/cstecgi.cgi and for unexpected device crashes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB CVE-2026-114382 vuldb.com
- VulDB vulnerability 424741 vuldb.com
- VulDB submission 1019881 vuldb.com
- Technical report (GitHub qwq-nm/CVE) github.com
- Strix CVE-2026-114382 www.strix.ai
- Hol.org CVE-2026-114382 hol.org
- TOTOLINK www.totolink.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:58.
Original description (NVD)
A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. The manipulation of the argument Comment results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.