Cyber Posture

CVE-2026-31027

CriticalPublic PoC

Published: 01 April 2026

Published
01 April 2026
Modified
07 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0115 78.7th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-31027 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Totolink A3600R Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mandates information input validation mechanisms at entry points to check parameters like rootSsid for length, preventing the buffer overflow condition.

prevent

Implements memory protection such as address space layout randomization and data execution prevention to mitigate exploitation of buffer overflows even if validation fails.

prevent

Requires timely flaw remediation to identify and patch the specific buffer overflow vulnerability in the setAppEasyWizardConfig interface.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is a remotely exploitable buffer overflow in a public-facing web interface (setAppEasyWizardConfig) on a router firmware, enabling arbitrary code execution without authentication, directly mapping to Exploit Public-Facing Application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

TOTOlink A3600R v5.9c.4959 contains a buffer overflow vulnerability in the setAppEasyWizardConfig interface of /lib/cste_modules/app.so. The vulnerability occurs because the rootSsid parameter is not properly validated for length, allowing remote attackers to trigger a buffer overflow, potentially leading to arbitrary code…

more

execution or denial of service.

Deeper analysisAI

CVE-2026-31027, published on 2026-04-01, is a buffer overflow vulnerability (CWE-120) in TOTOlink A3600R router firmware version v5.9c.4959. The flaw exists in the setAppEasyWizardConfig interface of the /lib/cste_modules/app.so library, where the rootSsid parameter is not properly validated for length, enabling a buffer overflow condition.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity. Remote attackers require no privileges or user interaction and can exploit it over the network with low attack complexity. Successful exploitation may lead to arbitrary code execution or denial of service on the targeted device.

Detailed technical analysis of the vulnerability is available in the referenced GitHub repository at https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3600R/rootSsid-setAppEasyWizardConfig.md. No vendor advisories or patches are mentioned in the provided information.

Details

CWE(s)

Affected Products

totolink
a3600r firmware
5.9c.4959

CVEs Like This One

CVE-2026-1686Same product: Totolink A3600R
CVE-2026-5020Same product: Totolink A3600R
CVE-2025-51630Same vendor: Totolink
CVE-2025-25609Same vendor: Totolink
CVE-2025-67186Same vendor: Totolink
CVE-2025-67188Same vendor: Totolink
CVE-2025-25635Same vendor: Totolink
CVE-2025-9303Same vendor: Totolink
CVE-2026-1328Same vendor: Totolink
CVE-2025-7460Same vendor: Totolink

References