Public exploit released for critical buffer overflow in TOTOLINK EX200 router firmware

A critical security vulnerability has been identified in the TOTOLINK EX200 router, specifically affecting firmware version 5.2.3c.7200. The flaw allows for remote exploitation via a stack-based buffer overflow, and functional exploit code has already been released to the public. This development raises the immediate risk profile for users of this specific hardware model who have not yet isolated their devices.

According to the National Vulnerability Database, the issue is tracked as CVE-2026-114382 and carries a CVSS base score of 9.3, classified as Critical. The vulnerability stems from improper handling of the Comment argument within the setStaticDhcpConfig function. This function resides in the /cgi-bin/cstecgi.cgi file, which is part of the lan.so component on the router. When an attacker sends a crafted request manipulating this argument, the system fails to validate the input size, leading to a stack-based buffer overflow.

Technical details and weaknesses

The National Vulnerability Database associates this vulnerability with two Common Weakness Enumerations: CWE-119 and CWE-121. CWE-119 refers to a general error-based buffer handling issue, while CWE-121 specifically denotes a stack-based buffer overflow. These weaknesses allow an attacker to overwrite adjacent memory locations on the stack. Because the flaw is located in a CGI script handling DHCP configurations, it is exposed to network traffic that can reach the device's management interface. The remote nature of the attack means no physical access to the router is required to trigger the overflow condition.

Affected systems and exposure

The vulnerability exclusively impacts the TOTOLINK EX200 model running firmware version 5.2.3c.7200. Other models or firmware versions are not listed as affected in the current advisory data. The release of the exploit to the public means that threat actors do not need to develop custom tooling to target this flaw. According to the NVD record, the exploit may be used for active attacks against systems running this specific software build. Security professionals should assume that any exposed instance of this firmware is currently vulnerable to compromise.

What should you do?

No patch or firmware update has been confirmed by the vendor to address this specific CVE. Users of the affected TOTOLINK EX200 device should review their network architecture to limit exposure. If the device is connected to the internet, consider isolating it or restricting access to its management interface. Monitor network logs for unusual traffic patterns that might indicate exploitation attempts. Await official guidance from TOTOLINK regarding a remediation plan or updated firmware release.