PT-2026-32225 · Totolink · Totolink A7000R

Dlchen · Published 2026-04-12 · Updated 2026-04-29 · CVE-2026-6168

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TOTOLINK A7000R versions up to 9.1.0u.6115

Description A stack-based buffer overflow exists in the setWiFiEasyGuestCfg() function within the '/cgi-bin/cstecgi.cgi' file. This issue is triggered by the manipulation of the ssid5g argument, allowing remote attackers to execute code.

Recommendations Avoid using the ssid5g parameter in the setWiFiEasyGuestCfg() function within the '/cgi-bin/cstecgi.cgi' file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

CVE-2026-6168

Affected Products

Totolink A7000R

References · 12

• 🔥 https://github.com/zhuchan770/vulnerability/blob/main/A7000R/setWiFiEasyGuestCfg/ToToLink%20A7000R%20setWiFiEasyGuestCfg%20338996b67c9780b89829d0ea70058788.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6168 · Security Note
• https://twitter.com/DFIR_Lab/status/2049291881218007212 · Twitter Post
• https://twitter.com/CVEnew/status/2043733065995047391 · Twitter Post
• https://vuldb.com/vuln/357056/cti · Note
• https://twitter.com/giuseppe_1337/status/2043616595780514259 · Twitter Post
• https://vuldb.com/vuln/357056 · Note
• https://vuldb.com/submit/797193 · Note
• https://twitter.com/vuldb/status/2043446618637434987 · Twitter Post
• https://twitter.com/CveFindCom/status/2043595819228557591 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2043706570043744764 · Twitter Post
• https://totolink.net · Note