PT-2026-36208 · Code Projects · Form Plugin

Xuanyu · Published 2026-04-30 · Updated 2026-04-30 · CVE-2026-7503

NVD

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

A vulnerability was detected in code-projects for Plugin 4.1.2cu.5137. The impacted element is the function setWiFiMultipleConfig in the library /lib/cste modules/wireless.so of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument wepkey2 results in buffer overflow. The attack can be launched remotely. The exploit is now public and may be used.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

CWE-119

Related Identifiers

CVE-2026-7503

Affected Products

Form Plugin

References · 6

• 🔥 https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A800R/02_Buffer_Overflow_setWiFiMultipleConfig.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7503 · Security Note
• https://vuldb.com/vuln/360313 · Note
• https://code-projects.org · Note
• https://vuldb.com/submit/803120 · Note
• https://vuldb.com/vuln/360313/cti · Note