Unpatched Buffer Overflow in Totolink EX1200L Router
CERT Polska disclosed an unauthenticated buffer overflow in Totolink EX1200L routers that allows remote code execution as root, with no vendor patch available.
CERT Polska coordinated disclosure of CVE-2026-44089, a buffer overflow vulnerability in the login functionality of the cgi-bin/cstecgi.cgi endpoint on Totolink EX1200L routers. The flaw can be triggered by an unauthenticated attacker to crash the device or achieve remote code execution with root privileges, enabling full compromise including reading and modifying data or bricking the device.
The vulnerability was confirmed on firmware version 9.3.5u.6146_B20201023, though other versions may also be affected. CERT Polska attempted to contact the vendor but received no response, meaning no official patch is currently available. This leaves affected devices exposed to potential exploitation, particularly concerning given the router's exposure to WAN-facing login interfaces typical of consumer/SOHO networking equipment.
The vulnerability was reported by researcher Franciszek Malek through CERT Polska's coordinated vulnerability disclosure process. No evidence of active exploitation in the wild is mentioned in the advisory; this is a disclosure of a newly identified flaw rather than a report of an ongoing attack campaign.
Mentioned in this report
Detection guidance
Oversized Request to Totolink cstecgi.cgi Login Endpoint
Detects anomalously large HTTP requests to the cgi-bin/cstecgi.cgi login endpoint on Totolink routers, consistent with buffer overflow exploitation attempts against CVE-2026-44089 (observable in reverse proxy / WAF / web server access logs sitting in front of or monitoring device management interfaces). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Oversized Request to Totolink cstecgi.cgi Login Endpoint
description: Detects HTTP requests to the Totolink EX1200L cgi-bin/cstecgi.cgi login
functionality where the request body/query is abnormally large, which is the generic
network-observable signature of a buffer overflow exploitation attempt (CVE-2026-44089).
Generalises on the vulnerable endpoint and oversized payload rather than a specific
exploit byte pattern.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /cgi-bin/cstecgi.cgi
size_anomaly:
cs-bytes|gt: 2048
condition: selection and size_anomaly
falsepositives:
- Legitimate firmware update or bulk configuration import operations against the same
endpoint that require large payloads
- Vulnerability scanners or authorized penetration tests probing the login endpoint
with large test payloads
level: medium
id: cc7c1ace-8ac4-5278-beb4-f4208c79d69a
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-44089
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free