{"id":"CVE-2026-114382","kind":"vulnerability","aliases":["CVE-2026-114382"],"related":[],"title":"TOTOLINK EX200 extender: remote stack overflow in DHCP config lets attackers run code","description":"A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. The manipulation of the argument Comment results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.","summary":"The TOTOLINK EX200 Wi-Fi extender firmware version 5.2.3c.7200 has a stack-based buffer overflow in the setStaticDhcpConfig function of its web CGI handler, triggered by the Comment argument. A remote attacker can send a crafted request to overwrite memory on the device, and a public exploit has been released.","severity":"critical","cvss":10.0,"epss":0.00667,"exploited":false,"exploited_at":null,"products":[{"name":"TOTOLINK EX200 firmware","fixed":[],"affected":"5.2.3c.7200","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["embedded","ex200","infrastructure","totolink","wifi-extender"],"not_affected_if":["different-firmware-version","no-remote-admin-exposure"],"how_to_check":"Check the firmware version under the device admin page or its system info; unknown whether the sources give a shell command.\nConfirm whether the web management interface is reachable from the internet or untrusted networks.","fix":"If no fix exists, restrict or disable remote access to the device's web interface.","status":"open","published_at":"2026-10-21T22:16:48+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:32:50+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T22:32:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown: sources do not name a fixed firmware version; check the TOTOLINK vendor site for an update.\nIf no fix exists, restrict or disable remote access to the device's web interface.","reach":"internet","title":"TOTOLINK EX200 extender: remote stack overflow in DHCP config lets attackers run code","impact":"high","summary":"The TOTOLINK EX200 Wi-Fi extender firmware version 5.2.3c.7200 has a stack-based buffer overflow in the setStaticDhcpConfig function of its web CGI handler, triggered by the Comment argument. A remote attacker can send a crafted request to overwrite memory on the device, and a public exploit has been released.","category":"infrastructure","who_cares":["totolink","ex200","wifi-extender","embedded"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs code on the extender remotely.","analyst_note":"Find whether TOTOLINK has released a fixed firmware for EX200 and whether the auth requirement for /cgi-bin/cstecgi.cgi is documented (NVD link in sources).","how_to_check":"Check the firmware version under the device admin page or its system info; unknown whether the sources give a shell command.\nConfirm whether the web management interface is reachable from the internet or untrusted networks.","needs_analyst":true,"not_affected_if":["different-firmware-version","no-remote-admin-exposure"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000569,"input_tokens":3000,"output_tokens":538,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether the setStaticDhcpConfig endpoint needs login, whether the device is exposed to WAN by default, and whether TOTOLINK has published a fixed firmware (check the NVD entry and TOTOLINK support pages).","search":"'-114382':16A,19A '-2026':15A,18A '/cgi-bin/cstecgi.cgi':102C '5.2.3':39B,92C 'affect':95C 'argument':61B,111C 'attack':11A,64B,126C,141C 'base':45B,117C 'buffer':46B,118C 'c.7200':40B,93C 'cgi':55B 'code':13A 'comment':60B,112C 'compon':105C 'config':9A 'craft':68B 'cve':14A,17A 'devic':75B 'dhcp':8A 'discov':88C 'embed':23B 'ex200':2A,21A,24B,32B,91C 'exploit':79B,129C 'extend':3A,29B,36B 'fi':35B 'file':101C 'firmwar':37B 'firmware':22A 'flaw':85C 'function':51B,97C 'handler':56B 'infrastructur':25B 'lan.so':106C 'launch':124C 'let':10A 'manipul':108C 'may':137C 'memori':72B 'overflow':6A,47B,119C 'overwrit':71B 'possibl':122C 'public':78B,135C 'releas':82B,132C 'remot':4A,63B,127C 'request':69B 'result':113C 'run':12A 'secur':84C 'send':66B 'setstaticdhcpconfig':50B,98C 'stack':5A,44B,116C 'stack-bas':43B,115C 'totolink':1A,20A,26B,31B,90C 'trigger':57B 'use':139C 'version':38B 'web':54B 'wi':34B 'wi-fi':33B 'wifi':28B 'wifi-extend':27B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T22:16:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114382","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114382","severity":null,"published_at":"2026-10-21T22:16:48+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114382:223","url":null,"severity":null,"published_at":"2026-10-23T22:26:20+00:00","modified_at":"2026-10-23T22:26:20+00:00","first_seen_at":"2026-10-23T22:26:20+00:00","fetched_at":"2026-10-23T22:26:20+00:00","note":"VulDB VDB-424741 (submitter zeroxf): unauthenticated remote, PoC public on GitHub (link not shown publicly, not found by me), no vendor fix or mitigation known; no TOTOLINK advisory found. Not verified: WAN exposure default. Sibling: CVE-2026-114383 (setWiFiAclAddConfig, same firmware)."},{"source":"epss","external_id":"CVE-2026-114382","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114382","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":1440,"url":"https://vuldb.com/vuln/424741","title":"VDB-424741 TOTOLINK EX200 setStaticDhcpConfig overflow","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}