Unpatched Buffer Overflow in Totolink EX1200L Router
CERT Polska disclosed an unauthenticated buffer overflow in Totolink EX1200L routers that allows remote code execution as root, with no vendor patch available.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of CVE-2026-44089, a buffer overflow vulnerability in the login functionality of the cgi-bin/cstecgi.cgi endpoint on Totolink EX1200L routers. The flaw can be triggered by an unauthenticated attacker to crash the device or achieve remote code execution with root privileges, enabling full compromise including reading and modifying data or bricking the device.
The vulnerability was confirmed on firmware version 9.3.5u.6146_B20201023, though other versions may also be affected. CERT Polska attempted to contact the vendor but received no response, meaning no official patch is currently available. This leaves affected devices exposed to potential exploitation, particularly concerning given the router's exposure to WAN-facing login interfaces typical of consumer/SOHO networking equipment.
The vulnerability was reported by researcher Franciszek Malek through CERT Polska's coordinated vulnerability disclosure process. No evidence of active exploitation in the wild is mentioned in the advisory; this is a disclosure of a newly identified flaw rather than a report of an ongoing attack campaign.
Mentioned in this report
Detection guidance
Oversized Request to Totolink cstecgi.cgi Login Endpoint
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects anomalously large HTTP requests to the cgi-bin/cstecgi.cgi login endpoint on Totolink routers, consistent with buffer overflow exploitation attempts against CVE-2026-44089 (observable in reverse proxy / WAF / web server access logs sitting in front of or monitoring device management interfaces). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Oversized Request to Totolink cstecgi.cgi Login Endpoint
description: Detects HTTP requests to the Totolink EX1200L cgi-bin/cstecgi.cgi login
functionality where the request body/query is abnormally large, which is the generic
network-observable signature of a buffer overflow exploitation attempt (CVE-2026-44089).
Generalises on the vulnerable endpoint and oversized payload rather than a specific
exploit byte pattern.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /cgi-bin/cstecgi.cgi
size_anomaly:
cs-bytes|gt: 2048
condition: selection and size_anomaly
falsepositives:
- Legitimate firmware update or bulk configuration import operations against the same
endpoint that require large payloads
- Vulnerability scanners or authorized penetration tests probing the login endpoint
with large test payloads
level: medium
id: cc7c1ace-8ac4-5278-beb4-f4208c79d69a
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-44089
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs