A publicly disclosed stack-based buffer overflow in the TOTOLINK N600R router's cstecgi.cgi handler allows unauthenticated remote attackers to fully compromise affected devices, carrying a CVSS v3.1 base score of 10.0.
What Is It
CVE-2026-79911 is a stack-based buffer overflow (CWE-121, CWE-119) in TOTOLINK N600R firmware version 4.3.0cu.7647_B20210106. The flaw resides in the setSystemConfig function of /cgi-bin/cstecgi.cgi, part of the device's CGI Handler component. Manipulation of the Hostname argument triggers the overflow. The attack can be launched remotely, and an exploit has been publicly disclosed and may already be in use.
Why It Matters
Per the VulDB entry, the CVSS v3.1 vector, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, scores a maximum 10.0 CRITICAL. That combination means no authentication, no user interaction, low attack complexity, network reach, and a changed scope with complete confidentiality, integrity, and availability impact. VulDB's CVSS v4.0 assessment scores 9.3 CRITICAL with an exploit maturity of PROOF_OF_CONCEPT, and its legacy CVSS v2 rating is 10.0 with COMPLETE impact across all three axes. These are VulDB-assigned scores; no NVD-published CVSS metrics were consulted for this brief.
In practical terms: anything that can reach the router's web interface can attempt this. Public exploit availability collapses the gap between disclosure and opportunistic scanning.
What's Vulnerable
- Vendor: TOTOLINK
- Product: N600R
- Affected version: 4.3.0cu.7647_B20210106
- Component: CGI Handler,
/cgi-bin/cstecgi.cgi, functionsetSystemConfig - Attack vector:
Hostnameparameter
CPE coverage is listed by VulDB as cpe:2.3:o:totolink:n600r_firmware:*:*:*:*:*:*:*:*.
Patch Status
No CISA KEV entry accompanies this CVE, so there is no federally mandated remediation deadline and no confirmation of active exploitation in the wild; only confirmed public exploit disclosure. The VulDB record lists no patch reference or vendor advisory. The CVE was published 2026-08-25, and the aggregated record indicates the entry has not yet completed analyst review; the NVD record itself was not directly consulted, so its current status and any analyst-assigned metadata should be verified independently at nvd.nist.gov before relying on them. Consult the TOTOLINK vendor site for firmware availability; until a fix is confirmed, restrict access to the device's management interface from untrusted networks.
Sources
- VulDB, CVE-2026-79911: https://vuldb.com/cve/CVE-2026-79911
- VulDB Entry 395061: https://vuldb.com/vuln/395061
- VulDB CTI Data: https://vuldb.com/vuln/395061/cti
- VulDB Submission 881258: https://vuldb.com/submit/881258
- Technical Write-up (GitHub, dxz0069): https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TOTOLINK_N600R_cstecgi_strcpy_sprintf_Multi_Function_Stack_Overflow.md
- TOTOLINK Vendor Site: https://www.totolink.net/