Loading story…
CERT Polska disclosed CVE-2026-44089, a stack-based buffer overflow in the Totolink EX1200L router that affects the login functionality of the cgi-bin/cstecgi.cgi endpoint. The flaw can be triggered without authentication and may allow an attacker to crash the service or achieve remote code execution, potentially gaining root-level control of the device.
The vulnerability was confirmed in firmware version 9.3.5u.6146_B20201023, and CERT Polska warned that other versions may also be affected because attempts to contact the vendor were unsuccessful. Successful exploitation could let an attacker read or modify data or even brick the router, and the issue was credited to researcher Franciszek Malek in the responsible disclosure report.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
CERT Polska disclosed CVE-2026-44089, a stack-based buffer overflow in the login functionality of the cgi-bin/cstecgi.cgi endpoint affecting Totolink EX1200L router software. The flaw was confirmed in firmware version 9.3.5u.6146_B20201023 and could allow unauthenticated attackers to crash the program or achieve remote code execution as root.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecvefeed.io
Open sourcecert.pl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two critical vulnerabilities, **CVE-2026-5851** and **CVE-2026-5976**, were disclosed in the **Totolink A7100RU** router running firmware `7.4cu.2313_b20191024`, exposing the device to remote **OS command injection** without authentication or user interaction. Both flaws affect `/cgi-bin/cstecgi.cgi` in the router's CGI handler: CVE-2026-5851 is tied to the `setUPnPCfg` function through the `enable` argument, while CVE-2026-5976 affects the `setStorageCfg` function through the `sambaEnabled` argument. The vulnerabilities were classified under **CWE-78** and **CWE-77** and were assigned high to critical severity across CVSS versions, reflecting potential compromise of confidentiality, integrity, and availability. Public exploit information has reportedly been released, including references to **VulDB** and a **GitHub** disclosure repository, increasing the likelihood of exploitation against exposed devices that have not been updated or otherwise mitigated.
Jun 29, 2026
Two high-severity command injection vulnerabilities have been disclosed in the **Totolink A3300R** router, both affecting firmware version `17.0.0cu.557_b20221024` and exposing the device to remote code execution through `/cgi-bin/cstecgi.cgi`. The flaws are tracked as **`CVE-2026-5104`** and **`CVE-2026-5101`**. `CVE-2026-5104` affects the `setStaticRoute` function, where manipulation of the `ip` argument can trigger command injection, while `CVE-2026-5101` affects the `setLanCfg` function in the Parameter Handler component through the `lanIp` argument. Public exploit material has been disclosed for both issues, according to VulDB and referenced advisory material, raising the risk of active abuse against exposed devices. NVD subsequently added initial analysis for the CVEs, assigning higher **CVSS v3.1** severity assessments than the original CNA submissions and mapping the weaknesses to **`CWE-77`**, **`CWE-74`**, and **`CWE-78`**. The disclosures indicate that attackers could remotely inject operating system commands via crafted requests, making patching, exposure reduction, and monitoring of internet-facing Totolink A3300R systems urgent priorities.
Jun 29, 2026
Two newly disclosed vulnerabilities, **CVE-2026-5854** and **CVE-2026-5977**, affect the **Totolink A7100RU** router running firmware `7.4cu.2313_b20191024` and allow **remote command execution** without authentication or user interaction. Both flaws are in the router’s CGI handler at `/cgi-bin/cstecgi.cgi`: CVE-2026-5854 is tied to the `setWiFiEasyCfg` function through the `merge` argument, while CVE-2026-5977 affects `setWiFiBasicCfg` through the `wifiOff` argument.
Jun 29, 2026