TOTOLINK EX200: Stack-based buffer overflow in setWiFiAclAddConfig
Summary
TOTOLINK EX200 firmware 5.2.3c.7200 contains a stack-based buffer overflow in the setWiFiAclAddConfig function of /cgi-bin/cstecgi.cgi (wireless.so) through the macAddress parameter. The endpoint requires no authentication, so a remote attacker can send an overlong macAddress value to crash the wireless service and potentially execute code. Public proof-of-concept material exists, and no vendor fix has been confirmed.
Affected
- TOTOLINK EX200 300Mbps Wireless Range Extender, firmware 5.2.3c.7200 (tested and listed as affected)
- Other firmware versions: not listed as affected, but not confirmed as safe
Fixed in
Unknown. No fixed firmware version has been published or confirmed.
Workaround
- Remove any WAN or internet exposure of the device's web management interface
- Restrict management access to a trusted admin VLAN or IP range
- Keep the device off guest and IoT network segments where possible
Exploitation
- Public proof-of-concept: yes (VulDB status: Proof-of-Concept, access: Public)
- Exploited in the wild: no known evidence
- Attack requires no authentication and no user interaction; the reported impact is denial of service, with possible code execution not confirmed
- CISA SSVC: exploitation PoC, automatable yes, technical impact total
Our recommendation
- Check whether any EX200 devices are reachable from the internet or untrusted networks and disconnect them immediately
- Restrict access to the web management interface to trusted administrators only
- Check the TOTOLINK website and firmware pages for an updated version and apply it when available
- Plan replacement of the device if no vendor fix appears
- Monitor the device for crashes or unexpected reboots
- Treat CVE-2026-114382 (setStaticDhcpConfig in lan.so, same firmware) as part of the same exposure
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-114383 GitHub report github.com
- VulDB CVE-2026-114383 vuldb.com
- VulDB submission 1019883 vuldb.com
- VulDB vulnerability 424742 vuldb.com
- VulDB CTI 424742 vuldb.com
- TOTOLINK website www.totolink.net
- OpenCVE CVE-2026-114383 app.opencve.io
- HOL Guard CVE-2026-114383 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:57.
Original description (NVD)
A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. This manipulation of the argument macAddress causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.