{"id":"CVE-2026-114383","kind":"vulnerability","aliases":["CVE-2026-114383"],"related":[],"title":"TOTOLINK EX200 router: stack overflow via Wi-Fi ACL macAddress lets attackers run code","description":"A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. This manipulation of the argument macAddress causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.","summary":"A stack-based buffer overflow in the setWiFiAclAddConfig function of the TOTOLINK EX200 router's web interface (/cgi-bin/cstecgi.cgi) is triggered by an oversized macAddress argument. A remote attacker can use the public exploit to crash the device or likely take control of it.","severity":"critical","cvss":10.0,"epss":0.00653,"exploited":false,"exploited_at":null,"products":[{"name":"TOTOLINK EX200 firmware","fixed":[],"affected":"= 5.2.3c.7200","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ex200","infrastructure","iot","router","self-hosted","totolink"],"not_affected_if":["default-config"],"how_to_check":"Open the EX200 admin page and read the firmware version under system status. 5.2.3c.7200 is the only confirmed-vulnerable version. Check whether the web interface is reachable from the internet or an untrusted network; sources do not say if it is by default.","fix":"No fixed firmware published as of 2026-10-23. Check https://www.totolink.net/ (EX200 download page) for firmware newer than 5.2.3c.7200. Until then, restrict the management interface to a trusted LAN, disable remote management, and consider replacing the device.","status":"open","published_at":"2026-10-21T22:16:49+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:32:47+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:32:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"TOTOLINK EX200 router: stack overflow via Wi-Fi ACL macAddress lets attackers run code","impact":"high","summary":"A stack-based buffer overflow in the setWiFiAclAddConfig function of the TOTOLINK EX200 router's web interface (/cgi-bin/cstecgi.cgi) is triggered by an oversized macAddress argument. A remote attacker can use the public exploit to crash the device or likely take control of it.","category":"infrastructure","who_cares":["totolink","ex200","router","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"attacker takes over the router remotely, running code on the device","analyst_note":"Check TOTOLINK's site for a firmware fix for EX200 beyond 5.2.3c.7200 and whether the admin interface is reachable from WAN by default; sources do not state a fixed version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000501,"input_tokens":3000,"output_tokens":401,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check TOTOLINK's site for a firmware fix for EX200 beyond 5.2.3c.7200 and whether the admin interface is reachable from WAN by default; sources do not state a fixed version.","search":"'-114383':18A,21A '-2026':17A,20A '/cgi-bin/cstecgi.cgi':51B,93C '5.2.3':83C 'acl':10A 'argument':58B,102C 'attack':13A,61B,111C,130C 'avail':121C 'base':36B,107C 'buffer':37B,108C 'c.7200':84C 'caus':104C 'code':15A 'compon':96C 'control':74B 'could':126C 'crash':68B 'cve':16A,19A 'devic':70B 'ex200':2A,23A,25B,46B,82C 'exploit':66B,117C 'fi':9A 'file':92C 'firmware':24A 'function':42B,88C 'host':31B 'identifi':79C 'impact':86C 'infrastructur':26B 'initi':114C 'interfac':50B 'iot':27B 'let':12A 'like':72B 'macaddress':11A,57B,103C 'made':120C 'manipul':99C 'overflow':5A,38B,109C 'overs':56B 'public':65B,124C 'remot':60B,115C 'router':3A,28B,47B 'run':14A 'self':30B 'self-host':29B 'setwifiacladdconfig':41B,89C 'stack':4A,35B,106C 'stack-bas':34B,105C 'take':73B 'totolink':1A,22A,32B,45B,81C 'trigger':53B 'use':63B,128C 'via':6A 'weak':76C 'web':49B 'wi':8A 'wi-fi':7A 'wireless.so':97C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T22:16:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-114383","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114383","severity":null,"published_at":"2026-10-21T22:16:49+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114383:222","url":null,"severity":null,"published_at":"2026-10-23T22:26:30+00:00","modified_at":"2026-10-23T22:26:30+00:00","first_seen_at":"2026-10-23T22:26:30+00:00","fetched_at":"2026-10-23T22:26:30+00:00","note":"Read CVE record, VulDB VDB-424742 and the public PoC report (qwq-nm). Unauthenticated per the PoC reporter; no TOTOLINK advisory or fixed firmware found (vendor page not checked in depth). CVSS 4.0 vector AV:N/AC:L/PR:N, E:P. No exploitation in the wild reported, KEV not listed. Did not search social."},{"source":"analyst","external_id":"CVE-2026-114383:307","url":null,"severity":null,"published_at":"2026-10-23T22:49:37+00:00","modified_at":"2026-10-23T22:49:37+00:00","first_seen_at":"2026-10-23T22:49:37+00:00","fetched_at":"2026-10-23T22:49:37+00:00","note":"Return visit: no new sources. Searched for a vendor fix; none found. TOTOLINK's download pages did not load (id/144 page empty), so fixed firmware is unknown. TOTOLINK TW lists a separate EX200_V2 with a 2026-08-06 release, which predates the CVE; not confirmed to be the same firmware line. WAN exposure by default not stated in any source. how_to_check and fix re-written because the signal showed them as unknown."},{"source":"epss","external_id":"CVE-2026-114383","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114383","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":1441,"url":"https://github.com/qwq-nm/CVE/blob/f5d61361eb7d846479f6d76c0aa4273e9af46d27/CVE2/report.md","title":"TOTOLINK EX200 setWiFiAclAddConfig overflow report and PoC (qwq-nm)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1442,"url":"https://vuldb.com/?id.424742","title":"VDB-424742 TOTOLINK EX200 setWiFiAclAddConfig","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1443,"url":"https://www.cve.org/CVERecord?id=CVE-2026-114383","title":"CVE Record CVE-2026-114383","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}