CVE Intelligence
Analysis AI-assisted

CVE-2026-44089: Totolink EX1200L Stack-based Buffer Overflow in Login Handler

A stack-based buffer overflow in the login functionality of the cgi-bin/cstecgi.cgi endpoint of the Totolink EX1200L router is rated critical, with CVSS v4.0 score 9.4, by the CNA CERT Polska. The description states that exploitation could crash the program and allow remote code execution with root-level impact. The vulnerability was confirmed only in version 9.3.5u.6146_B20201023, and the vendor did not respond to contact attempts.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-44089 affects the Totolink EX1200L router. According to the CNA, CERT Polska, the login functionality of the cgi-bin/cstecgi.cgi endpoint contains a stack-based buffer overflow (CWE-121). The record was published on 2026-06-23 and carries the source status Deferred. Details are published in the CERT Polska advisory.

Impact

  • The description states that exploitation could crash the program and allow remote code execution.
  • It states that an attacker could act as root, including reading and editing data, and could leave the router inoperable (bricking).
  • The CNA reports CVSS v4.0 base score 9.4 (critical), with an adjacent network attack vector, low attack complexity, no privileges and no user interaction required, and high impact on confidentiality, integrity and availability.

Affected products and versions

  • Product: Totolink EX1200L router.
  • Confirmed version: 9.3.5u.6146_B20201023 only.
  • Other versions may be affected, but this could not be verified because the vendor did not respond.
  • The record contains no structured affected or fixed version data. Consult the vendor download page for firmware information.

Exploitation status

This CVE is not listed in the CISA KEV catalog in the record consulted. No confirmed exploitation in the wild appears in the sources consulted. This is not evidence that exploitation does not occur, only that none is documented in these sources.

Remediation and mitigation

  • Inventory all Totolink EX1200L devices and record the firmware version of each one.
  • Check the vendor download page for firmware updates. The record does not state whether a fix exists or which version contains it.
  • Restrict access to the device management interface to trusted administrative networks and do not expose it to untrusted networks or the internet.
  • If no update is available, plan to replace unsupported devices and treat the current device as at risk.
  • Review the CERT Polska advisory for any additional guidance from the coordinating party.

Detection guidance

  • Monitor logs and network traffic reaching the management interface for unusual or malformed requests to the cstecgi.cgi endpoint.
  • Watch for unexpected device crashes, reboots, configuration changes or loss of connectivity, which may indicate abuse.
  • Alert on administrative access from unexpected sources.

Limitations of the available information

  • The vendor did not respond, so no official fixed version or patch statement is available in the record.
  • Only one firmware version is confirmed as affected; the scope across other versions and models is unknown.
  • No EPSS score, SSVC data or affected product list is present in the record.
  • The technical details of the flaw beyond the stated class and endpoint are not provided here.

Frequently asked questions

Is CVE-2026-44089 known to be actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. This does not rule out exploitation, so treat the device as at risk.

Which Totolink EX1200L versions are affected?

The vulnerability is confirmed only in version 9.3.5u.6146_B20201023. Other versions may be affected, but the vendor did not respond and this could not be verified.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.