---
id: "CVE-2026-114383"
kind: "vulnerability"
aliases: ["CVE-2026-114383"]
title: "TOTOLINK EX200 router: stack overflow via Wi-Fi ACL macAddress lets attackers run code"
severity: "critical"
cvss: 10.0
epss: 0.00653
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "TOTOLINK EX200 firmware", "fixed": [], "affected": "= 5.2.3c.7200", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ex200", "infrastructure", "iot", "router", "self-hosted", "totolink"]
not_affected_if: ["default-config"]
published_at: "2026-10-21T22:16:49+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114383", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:26:30+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:49:37+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114383", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# TOTOLINK EX200 router: stack overflow via Wi-Fi ACL macAddress lets attackers run code

A stack-based buffer overflow in the setWiFiAclAddConfig function of the TOTOLINK EX200 router's web interface (/cgi-bin/cstecgi.cgi) is triggered by an oversized macAddress argument. A remote attacker can use the public exploit to crash the device or likely take control of it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:TOTOLINK EX200 firmware affected = 5.2.3c.7200 fixed ?

## How to check

Open the EX200 admin page and read the firmware version under system status. 5.2.3c.7200 is the only confirmed-vulnerable version. Check whether the web interface is reachable from the internet or an untrusted network; sources do not say if it is by default.

## Fix

No fixed firmware published as of 2026-10-23. Check https://www.totolink.net/ (EX200 download page) for firmware newer than 5.2.3c.7200. Until then, restrict the management interface to a trusted LAN, disable remote management, and consider replacing the device.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114383
- 2026-10-23T22:26:30+00:00 analyst — Read CVE record, VulDB VDB-424742 and the public PoC report (qwq-nm). Unauthenticated per the PoC reporter; no TOTOLINK advisory or fixed firmware found (vendor page not checked in depth). CVSS 4.0 vector AV:N/AC:L/PR:N, E:P. No exploitation in the wild reported, KEV not listed. Did not search social.
- 2026-10-23T22:49:37+00:00 analyst — Return visit: no new sources. Searched for a vendor fix; none found. TOTOLINK's download pages did not load (id/144 page empty), so fixed firmware is unknown. TOTOLINK TW lists a separate EX200_V2 with a 2026-08-06 release, which predates the CVE; not confirmed to be the same firmware line. WAN exposure by default not stated in any source. how_to_check and fix re-written because the signal showed them as unknown.
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114383

## Documents

- [advisory] VDB-424742 TOTOLINK EX200 setWiFiAclAddConfig https://vuldb.com/?id.424742
- [describes] CVE Record CVE-2026-114383 https://www.cve.org/CVERecord?id=CVE-2026-114383
- [poc] TOTOLINK EX200 setWiFiAclAddConfig overflow report and PoC (qwq-nm) https://github.com/qwq-nm/CVE/blob/f5d61361eb7d846479f6d76c0aa4273e9af46d27/CVE2/report.md

## From the sources

A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. This manipulation of the argument macAddress causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_