Cyber & AI intelligence
Wasteland.
Briefs indexed2348
Issues26
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-82616 2026-08-31

TOTOLINK NR1800X Stack Overflow in setUploadSetting (CVE-2026-82616)

"A publicly disclosed stack-based buffer overflow in the TOTOLINK NR1800X router's `setUploadSetting` CGI handler lets a remote, low-privileged attacker corrupt memory with full impact to confidentiality, integrity, and…"

A publicly disclosed stack-based buffer overflow in the TOTOLINK NR1800X router's setUploadSetting CGI handler lets a remote, low-privileged attacker corrupt memory with full impact to confidentiality, integrity, and availability.

What Is It

CVE-2026-82616 is a stack-based buffer overflow (CWE-121, CWE-119) in TOTOLINK NR1800X firmware version 9.1.0u.6681_B20230703. The flaw sits in the setUploadSetting function of /cgi-bin/cstecgi.cgi. Manipulation of the FileName argument triggers the overflow. The attack can be executed remotely, and per the published record the exploit has been made public and could be used.

Why It Matters

The severity scores currently attached to this CVE come from the assigning CNA (VulDB), not from NVD analysis, the NVD entry is still in "Received" status as of 2026-08-31 and carries no NVD-generated score of its own. On the CNA's assessment, the CVSS 3.1 base score is 9.9 (CRITICAL), vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, network-reachable, low attack complexity, no user interaction, and a changed scope with high confidentiality, integrity, and availability impact. The same source's CVSS 4.0 assessment scores 8.6 (HIGH) and explicitly marks exploit maturity as PROOF_OF_CONCEPT, consistent with a public writeup being available. Only low privileges are required, so any account or credential foothold on the device's web interface is enough to reach the vulnerable handler. Expect the numbers to shift if and when NVD completes its own analysis.

CVE-2026-82616 is not listed in CISA's Known Exploited Vulnerabilities catalog as of 2026-08-31, so there is no U.S. government confirmation of active in-the-wild exploitation and no BOD 22-01 remediation deadline attached to it. That is a narrow distinction; public proof-of-concept code on an internet-facing SOHO router narrows the gap between disclosure and opportunistic use.

What's Vulnerable

Patch Status

Neither the NVD entry nor the VulDB records for this CVE list a patch, a fixed firmware version, or a vendor advisory. The NVD entry references only TOTOLINK's main site rather than a security bulletin, and no TOTOLINK advisory for this issue could be located as of 2026-08-31. With no vendor fix identified, restricting access to the device's web management interface, keeping it off the WAN and limiting LAN access to trusted hosts, is the practical mitigation until firmware guidance is released.

Sources