Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2026-85031: TOTOLINK CP450 allows remote code execution via URL parameter
CVE-2026-85031 · published 2 months ago
Summary
The web interface on the TOTOLINK CP450 router has a flaw in the cstecgi.cgi page that can be triggered by sending a specially crafted topicurl value. This overflow can let an attacker run their own code on the device from a distance. Install the latest firmware or apply the vendor's security update as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| totolink | cp450 | 4.1.0 |
Original advisory text
TOTOLINK CP450 cstecgi.cgi buffer overflow
A vulnerability was found in TOTOLINK CP450 4.1.0. The impacted element is an unknown function of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument topicurl results in buffer overflow. Remote exploitation of the attack is possible.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.6
High
Type
CWE-120Classic Buffer Overflow
CWE-119Buffer Overflow
Timeline
Published3 Sep 2026
Updated4 Nov 2026
First seen3 Sep 2026
Track software like this
Free during beta