SYS::ONLINE
Wasteland.
Briefs2256
Issues25
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-79911 2026-08-25

CVE-2026-79911: Critical Stack Buffer Overflow in TOTOLINK N600R CGI Handler

"A publicly disclosed stack-based buffer overflow in the TOTOLINK N600R router's `cstecgi.cgi` handler allows unauthenticated remote attackers to fully compromise affected devices, carrying a CVSS v3.1 base score of 10.0."

A publicly disclosed stack-based buffer overflow in the TOTOLINK N600R router's cstecgi.cgi handler allows unauthenticated remote attackers to fully compromise affected devices, carrying a CVSS v3.1 base score of 10.0.

What Is It

CVE-2026-79911 is a stack-based buffer overflow (CWE-121, CWE-119) in TOTOLINK N600R firmware version 4.3.0cu.7647_B20210106. The flaw resides in the setSystemConfig function of /cgi-bin/cstecgi.cgi, part of the device's CGI Handler component. Manipulation of the Hostname argument triggers the overflow. The attack can be launched remotely, and an exploit has been publicly disclosed and may already be in use.

Why It Matters

Per the VulDB entry, the CVSS v3.1 vector, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, scores a maximum 10.0 CRITICAL. That combination means no authentication, no user interaction, low attack complexity, network reach, and a changed scope with complete confidentiality, integrity, and availability impact. VulDB's CVSS v4.0 assessment scores 9.3 CRITICAL with an exploit maturity of PROOF_OF_CONCEPT, and its legacy CVSS v2 rating is 10.0 with COMPLETE impact across all three axes. These are VulDB-assigned scores; no NVD-published CVSS metrics were consulted for this brief.

In practical terms: anything that can reach the router's web interface can attempt this. Public exploit availability collapses the gap between disclosure and opportunistic scanning.

What's Vulnerable

CPE coverage is listed by VulDB as cpe:2.3:o:totolink:n600r_firmware:*:*:*:*:*:*:*:*.

Patch Status

No CISA KEV entry accompanies this CVE, so there is no federally mandated remediation deadline and no confirmation of active exploitation in the wild; only confirmed public exploit disclosure. The VulDB record lists no patch reference or vendor advisory. The CVE was published 2026-08-25, and the aggregated record indicates the entry has not yet completed analyst review; the NVD record itself was not directly consulted, so its current status and any analyst-assigned metadata should be verified independently at nvd.nist.gov before relying on them. Consult the TOTOLINK vendor site for firmware availability; until a fix is confirmed, restrict access to the device's management interface from untrusted networks.

Sources