CVE-2023-7220 is a buffer overflow in the loginAuth function of the Totolink NR1800X, firmware 9.1.0u.6279_B20210910. It scores 9.8 (Critical). The vendor did not respond to the reporter and the record names no fixed firmware, so keep the web admin interface off the internet and look for new firmware.
What's affected
Affected: Totolink NR1800X on firmware 9.1.0u.6279_B20210910. The vulnerable code is the loginAuth function of /cgi-bin/cstecgi.cgi, and the argument is password.
Fixed: none is named in the record. The description says the vendor was contacted early about the disclosure and did not respond in any way. I found no vendor advisory, so check Totolink's download page for newer firmware before concluding that nothing exists.
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The attacker needs no account. The weakness is CWE-121. The record says the exploit has been disclosed to the public and may be used. The KEV flag is false and no source I read says it is exploited in the wild.
This is the most serious of the Totolink records in this series, because the vector needs no privileges and no user interaction, and all three impact areas are rated high. It is a critical score of 9.8 in NVD.
How to check if you're exposed
Sign in to the router's web interface and read the firmware version on the status or system page. If it matches 9.1.0u.6279_B20210910 on a NR1800X, you are on the version named in the record.
Next, check exposure. From a device outside your network, see whether the router's public address answers on its admin port. A router with remote management enabled is reachable by anyone, and this class of bug is attacked through the same web server that serves the login page.
What to do now
- Look on the Totolink support site for firmware newer than the version you run, and apply it if one exists.
- Turn off remote management so the admin interface is reachable only from your local network.
- Keep untrusted devices, including guest Wi-Fi, off the segment that can reach the admin page.
- Change the admin password to a long unique one, and do not reuse it elsewhere.
- If no fix appears, plan to replace the router. An unpatched, unsupported edge device is a standing risk.
Why it matters
A buffer overflow happens when code copies input into a fixed size memory area without checking the length. On this class of router, the web server handles requests as a privileged process, so memory corruption in a login or settings handler can mean control of the device. The out-of-bounds write and stack overflow weaknesses here are among the most common in embedded firmware, because the code is written in C and input handling is often thin.
Control of a router is control of the traffic that passes through it. That includes DNS settings, port forwards and anything sent without end to end encryption. The practical defenses without a patch are to shrink exposure and to replace devices the vendor no longer supports.
A critical score is a statement about the bug, not about your exposure. A router whose admin page is reachable only from a wired management port is far less at risk than one with remote management turned on.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch for CVE-2023-7220?
The record names no fixed firmware and the vendor did not respond to the reporter. Check Totolink's download page and treat the firmware in the record as vulnerable.
Can I fix it by changing my password?
No. A password does not fix a memory bug in the web server. Reducing who can reach the admin interface is the control that helps.
Sources
Last reviewed: 19 October 2026.
