CVE-2026-44089: Buffer Overflow in Totolink EX1200L router

Synopsis

A stack-based buffer overflow in the Totolink EX1200L router's login handler (cgi-bin/cstecgi.cgi) allows an unauthenticated attacker on the same network segment to overflow a buffer in the login functionality. No credentials are required, and exploitation gives the attacker full root-level code execution on the device. Successful exploitation enables reading and modifying all stored data, crashing the router, or permanently bricking the device. No fix has been published by the vendor; HarborGuard tracks this advisory and will make a patched rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same adjacent network segment (LAN, Wi-Fi, or VPN) as the router; remote internet-based exploitation is not possible without prior network access.

• AuthenticationNot required

  The vulnerability exists in the pre-authentication login handler, so no credentials or account of any privilege level are needed.

• Victim interactionNot required

  Exploitation is fully attacker-driven; no user action such as clicking a link or opening a file is required.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, special memory layout, or environmental setup beyond network adjacency.

Blast Radius

• Attacker executes arbitrary code as root on the router, gaining full control of the device.
• All data stored or transiting the router (credentials, session tokens, network traffic) is readable by the attacker.
• Attacker can modify router configuration, redirect or intercept network traffic, and alter persisted settings.
• Attacker can permanently brick the router by overwriting firmware or critical flash storage, causing irreversible denial of service.