A critical stack-based buffer overflow in the macAddress argument of TOTOLINK EX200 firmware 5.2.3c.7200 can be triggered remotely, and a public exploit is available.
What Is It
CVE-2026-114383 is a stack-based buffer overflow (CWE-121, CWE-119) in the TOTOLINK EX200. The flaw is in the setWiFiAclAddConfig function, which is handled through /cgi-bin/cstecgi.cgi in the wireless.so component. A crafted macAddress argument overflows a stack buffer.
VulDB, the CNA, published the record on 2026-10-21. NVD lists its status as "Received," so NVD has not yet completed its own analysis.
Why It Matters
The CNA rates the flaw at the top of the severity scale:
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL, with exploit maturity rated as Proof-of-Concept
- CVSS 2.0: 10.0
The vectors describe an attack over the network with low complexity that needs no privileges and no user interaction. Confidentiality, integrity and availability impacts are all high, and the CVSS 3.1 scope is "Changed." The CNA also says the exploit "has been made available to the public and could be used for attacks." A public proof-of-concept report is linked in the references.
KEV status: CISA's Known Exploited Vulnerabilities catalog has no entry for this CVE in the supplied data. Active exploitation in the wild is therefore not confirmed by KEV.
What's Vulnerable
- Vendor: TOTOLINK
- Product: EX200
- Affected version: 5.2.3c.7200
- Component:
wireless.so(/cgi-bin/cstecgi.cgi, functionsetWiFiAclAddConfig) - CPE:
cpe:2.3:o:totolink:ex200_firmware:*:*:*:*:*:*:*:*
The supplied data lists only firmware version 5.2.3c.7200 as affected.
Patch Status
The supplied NVD record has no vendor advisory, fixed firmware version or remediation guidance. Because the CVE is not in KEV, there is no CISA required action or due date. The references include TOTOLINK's homepage but no specific security bulletin. Owners of EX200 devices running 5.2.3c.7200 should check TOTOLINK directly for updated firmware. Until a fix is confirmed, they should limit network access to the device's management interface.