CVE-2026-85031 is a remote buffer overflow in TOTOLINK CP450 firmware 4.1.0 (CVSS 9.9, critical). The record names the topicurl argument of /cgi-bin/cstecgi.cgi. It lists no fixed firmware, so isolate the device and check the vendor site. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The record names TOTOLINK CP450 version 4.1.0 and the file /cgi-bin/cstecgi.cgi. The manipulated argument is topicurl. The weaknesses are CWE-119 and CWE-120, both buffer overflow classes. The record says remote exploitation is possible.
No fixed version is listed in the record, and I could not confirm one from the vendor. The record is not in the CISA KEV catalog, and it does not say the flaw is exploited in the wild.
How to check if you're exposed
Log in to the device management page and read the firmware version. If it shows 4.1.0 on a CP450, treat it as affected. From a network scan, look for devices that expose a web management interface on the CP450 and confirm that interface is not reachable from the internet.
What to do now
- Remove any internet exposure of the management interface now.
- Place the device on a separate network segment with limited access.
- Check the TOTOLINK site for newer CP450 firmware and apply it if one is published.
- Restrict the management interface to a trusted admin address.
- If no fix appears and the device is critical, plan to replace it.
Why it matters
A buffer overflow in a CGI handler means a request parameter is copied into a fixed size memory area without a length check. On embedded devices the web service often runs as root, which is why the consequences can be severe.
Small office network gear tends to be installed once and never updated. Keeping an inventory of such devices, and knowing which face the internet, is the first useful step.
Quick check
Is there a patch?
The record lists none. Check the vendor site for firmware newer than 4.1.0 and, if none exists, limit exposure.
Sources
Last reviewed: 19 October 2026.
