CVE-2026-82616

TOTOLINK NR1800X routers running firmware 9.1.0u.6681_B20230703 contain a stack-based buffer overflow (CWE-121) in the setUploadSetting function of the /cgi-bin/cstecgi.cgi endpoint. It is triggered by a remote request that supplies a manipulated or oversized FileName parameter to this CGI handler, overrunning a fixed-size stack buffer; the CVSS 4.0 vector (AV:N, PR:L) indicates the attacker needs network access and only low-privilege (authenticated) access. Successful exploitation corrupts process memory with high impact on confidentiality, integrity, and availability (C:H/VI:H/VA:H), which for a router typically enables control of the device's management process and potentially full device takeover. Operators of TOTOLINK NR1800X routers on the affected firmware build are affected, particularly those whose web management interface is reachable from untrusted networks. Exploit details have been made public per the disclosure, but the flaw is not in CISA KEV and EPSS currently estimates only a ~0.6% probability of exploitation in the next 30 days.

What to do: Check the running firmware version in the router's admin interface; if it is 9.1.0u.6681_B20230703, restrict or firewall the web management interface (cstecgi.cgi) so it is not reachable from the WAN or other untrusted networks, and limit the number of low-privilege admin accounts. Watch TOTOLINK advisories for a fixed firmware release and upgrade as soon as one is published (no fixed version is identified in the available data). Monitor for exploitation attempts against cstecgi.cgi, as exploit details are public.