cyberresearch.us

TLP:CLEAR confidence:low · #cyber-news #CVE-2026-19844 #CVE-2026-19845 #emerging

CVE-2026-19847 | TOTOLINK A800R 4.1.2cu.5137_B20200730 wps.so /cgi-bin/cstecgi.cgi

Luke Johnson / Cyber Research US

Summary

Public VulDB listings describe four critical buffer-overflow issues in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730, all reached through /cgi-bin/cstecgi.cgi in different shared objects (ipv6.so, lan.so, firewall.so, wps.so). Each entry states the attack can be performed over the network and that an exploit is available. This memo is a synthesis of those public listings only; it does not independently reverse or lab the firmware, and the sources do not claim confirmed victim exploitation.

Attack vector

The reported surface is the device’s CGI interface at /cgi-bin/cstecgi.cgi, reachable over the network (scip VulDB). Attackers influence a named argument to a specific handler:

  • setRadvdCfg in ipv6.so — argument radvdinterfacename (CVE-2026-19844)
  • setStaticDhcpConfig in lan.so — argument Kommentar (comment) (CVE-2026-19845)
  • setUrlFilterRules in firewall.so — parameter url (CVE-2026-19846)
  • setWiFiWpsConfig in wps.so — argument pin (CVE-2026-19847)

HTTP method, whether the management interface must be exposed on WAN vs LAN, and whether a session or credentials are required are not stated.

Exploit

Bug class is buffer overflow (Pufferüberlauf) caused by manipulating the arguments above (scip VulDB). No stack-versus-heap distinction, overflow length, memory layout, post-overflow control-flow, or privilege after exploit is given. VulDB states an exploit is available for each CVE but does not publish the payload, tooling, or chain stages in these articles. Do not treat “exploit available” as a documented RCE recipe.

In the wild / novelty

Not stated as active campaigns or confirmed victim use. These items are vulnerability disclosures with a claim that an exploit exists. No honeypot hits, no named reporter of in-the-wild abuse, and no timeline beyond the listings themselves.

Risk

VulDB rates each issue critical. Successful abuse would target the A800R’s CGI/config path and could affect router integrity, LAN/IPv6/WPS/URL-filter configuration, and whatever process handles cstecgi.cgi. Blast radius beyond that firmware/model, and whether unauthenticated remote code execution is actually achieved, are not specified in the sources.

Remediation

No vendor patch, fixed version, or configuration workaround is given in these articles. Defenders should treat the listed firmware build as affected, restrict access to the router admin/CGI interface to trusted management networks, and monitor for unusual POSTs/requests to /cgi-bin/cstecgi.cgi that set RADVD, static DHCP, URL-filter, or WPS parameters. Validate any fix only against a vendor advisory when one appears; these RSS items do not provide a verification procedure.

CVE / identifiers

CVE-2026-19844, CVE-2026-19845, CVE-2026-19846, CVE-2026-19847 (TOTOLINK A800R 4.1.2cu.5137_B20200730). CWE not stated.

Confidence

low — single-outlet VulDB RSS summaries, no second-source technical write-up, no auth/precondition detail, and no exploit internals.

Open questions

Whether authentication is required; WAN versus LAN exposure; stack vs heap and whether overflow yields code execution or only DoS; where the claimed exploits are published and whether they are public PoCs; vendor acknowledgment and patched firmware; whether 19846/19847 share a common unsafe CGI parsing pattern with 19844/19845.

Sources