CVE-2026-1143

TOTOLINK A3700R cstecgi.cgi setWiFiEasyGuestCfg buffer overflow

A weakness has been identified in TOTOLINK A3700R 9.1.2u.5822_B20200513. This affects the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument ssid can lead to buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

Affected

TOTOLINK · A3700R

CVSS v4.0 VULDB

7.4 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 VULDB

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 VULDB

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

0.76% chance of exploitation in the next 30 days, 55th percentile

Published

2026-01-19

Updated

2026-02-23

Proof-of-concept exploits (1)

• https://lavender-bicycle-a5a.notion.site/TOTOLINK-A3700R-setWiFiEasyGuestCfg-2e353a41781f…

Security advisories

• https://vuldb.com/?id.341735
• https://vuldb.com/?submit.735502
• https://www.totolink.net

References

• CVE Record
• NVD entry