CVE-2026-114382 is a critical (CVSS 3.1: 10.0) stack-based buffer overflow in TOTOLINK EX200 firmware 5.2.3c.7200. Attackers can trigger it remotely without authentication, and a public exploit has been released.
What Is It
The flaw is in the setStaticDhcpConfig function of /cgi-bin/cstecgi.cgi, inside the lan.so component of the TOTOLINK EX200. An attacker who manipulates the Comment argument can cause a stack-based buffer overflow. VulDB, the CNA, classifies the weakness as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
NVD published the record on 2026-10-21 and lists its status as "Received." NVD has not yet completed its own analysis.
Why It Matters
The CNA rates the issue Critical under both CVSS 3.1 and CVSS 4.0. Under CVSS 3.1 and CVSS 2.0 it gets the maximum score of 10.0:
- CVSS 3.1: 10.0 Critical (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 Critical, with exploit maturity rated Proof-of-Concept
- CVSS 2.0: 10.0
The attack works over the network and has low complexity. It needs no privileges and no user interaction. Confidentiality, integrity and availability impact are all rated high. The scope is "changed," which means the impact can reach beyond the vulnerable component. The NVD description says the exploit "has been released to the public and may be used for attacks," and the references link to a public write-up.
This CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation in the wild. Still, the exploit is public and needs no authentication, so exposed devices are likely targets.
What's Vulnerable
- Vendor: TOTOLINK
- Product: EX200
- Affected version: 5.2.3c.7200
- Component:
lan.so(/cgi-bin/cstecgi.cgi, functionsetStaticDhcpConfig) - CPE:
cpe:2.3:o:totolink:ex200_firmware:*:*:*:*:*:*:*:*
The supplied records name only firmware 5.2.3c.7200 as affected.
Patch Status
The supplied NVD record lists no vendor patch or fixed firmware version. The CVE has no KEV entry, so CISA has issued no required action or due date. Owners of EX200 devices running 5.2.3c.7200 should check TOTOLINK's site for updated firmware. Until a fix is confirmed, they should limit network access to the device's web management interface.