CVE-2026-85031

TOTOLINK CP450 routers running firmware 4.1.0 contain a buffer overflow (CWE-119/CWE-120) in an unspecified function of the web management endpoint /cgi-bin/cstecgi.cgi. An attacker triggers the flaw by manipulating the topicurl argument sent to this endpoint over the network, and the CVSS 4.0 vector (PR:L) indicates some level of privileged/authenticated access is likely required. Successful exploitation causes memory corruption with high impact on the router's confidentiality, integrity and availability, potentially enabling code execution or a crash of the device. Only TOTOLINK CP450 devices on version 4.1.0 are known to be affected. There is currently no public proof-of-concept, no reported in-the-wild exploitation, and the device is not in CISA KEV; EPSS estimates only a ~0.6% chance of exploitation within 30 days.

What to do: Inventory for TOTOLINK CP450 devices running firmware 4.1.0 and check TOTOLINK's official site for a patched firmware release; do not expose the router's web management interface (cstecgi.cgi) directly to the internet, and restrict it to trusted management networks until a fix is available. Continue monitoring TOTOLINK advisories, since no public PoC exists yet but flaws of this type in TOTOLINK web endpoints have historically been rapidly weaponized.