CVE-2026-19846 is a high severity (CVSS 8.8) stack-based buffer overflow in the TOTOLINK A800R router, firmware 4.1.2cu.5137_B20200730. The setUrlFilterRules function mishandles the url argument. The record says it can be attacked remotely and a public exploit exists. We could not confirm a fixed version.
What's affected
The record names one affected build: TOTOLINK A800R firmware 4.1.2cu.5137_B20200730. The vulnerable code is the setUrlFilterRules function in /cgi-bin/cstecgi.cgi, in the firewall.so component. The weakness is listed as CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-121 (stack-based buffer overflow).
The score is 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The record says the attack can be started remotely and that the exploit is publicly available and might be used. It does not set a KEV flag, and we are not claiming exploitation in the wild.
The reference pages for this record (a researcher write-up and VulDB) could not be read in our session, and TOTOLINK's site was the only vendor page listed. We therefore cannot name a fixed version, and we will not guess one. Check the TOTOLINK support site for newer A800R firmware and ask the vendor directly if none is listed.
How to check if you're exposed
Log in to the router's admin interface and read the firmware version on the status or system page. A value of 4.1.2cu.5137_B20200730 matches the build in the record. Other builds are not confirmed either way, so absence of that exact string is not proof of safety.
Next, find out whether the management interface is reachable from anywhere other than your trusted LAN. From a device outside the network, test whether the router's admin port answers. If it does, close it. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers application dependencies, so it will not see operating system, firmware or driver issues like this one. For those, rely on your asset inventory and the vendor advisory.
What to do now
- Identify any TOTOLINK A800R routers in your estate, including at home offices and small sites.
- Check the TOTOLINK support page for newer firmware than 4.1.2cu.5137_B20200730 and install it if it exists.
- Turn off remote administration and any WAN side access to the web interface.
- Limit LAN side access to the admin page to one management device where possible.
- If the vendor offers no fix, plan to replace the router with a supported model.
- Change the admin password and review settings for unexpected changes.
Why it matters
CWE-119 (improper restriction of operations within the bounds of a memory buffer) is the classic memory flaw: the code copies attacker supplied data into a fixed size stack buffer without checking its length. On a router, the outcome can be a crash or code execution with the device's privileges. Because the vector reaches the device over the network and needs only low privileges, one reachable management page can be enough.
Small office routers rarely get firmware updates on a schedule, and public exploit write-ups shorten the window between disclosure and misuse. The safest posture is to assume the management interface must not face the internet, update when a vendor fix exists, and retire hardware that no longer gets fixes.
Quick check
Is there a patch?
We could not confirm one from the pages available to us. Check the TOTOLINK support site and the record's references.
Is it exploited in the wild?
The record says a public exploit exists, but it does not set the KEV flag. Treat the risk as real without claiming confirmed exploitation.
Sources
Last reviewed: 18 October 2026.
