CVE-2026-6168
Published: 13 April 2026
Summary
CVE-2026-6168 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Totolink (inferred from references). Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-6168 is a stack-based buffer overflow vulnerability in the TOTOLINK A7000R router firmware versions up to 9.1.0u.6115. The issue resides in the setWiFiEasyGuestCfg function within the /cgi-bin/cstecgi.cgi file, where manipulation of the ssid5g argument triggers the overflow. It has been assigned CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability was published on 2026-04-13.
Remote exploitation is possible by attackers who have low privileges, such as authenticated users, requiring network access with low complexity and no user interaction. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution on the affected device.
Advisories and details are documented on VulDB (vuldb.com/vuln/357056 and related pages) and a GitHub repository containing a published exploit (github.com/zhuchan770/vulnerability/blob/main/A7000R/setWiFiEasyGuestCfg/...). The vendor website (totolink.net) is referenced, though specific patch information is not detailed in available sources.
The exploit has been publicly released, increasing the risk of real-world attacks against unpatched TOTOLINK A7000R devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21893
Vulnerability details
A flaw has been found in TOTOLINK A7000R up to 9.1.0u.6115. The affected element is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ssid5g causes stack-based buffer overflow. Remote exploitation of the attack is possible. The…
more
exploit has been published and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote stack-based buffer overflow in a public-facing web CGI script (/cgi-bin/cstecgi.cgi) on the router, directly enabling exploitation of a public-facing application for arbitrary code execution from an authenticated low-privilege context.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of the ssid5g argument in setWiFiEasyGuestCfg to enforce bounds checking and prevent stack-based buffer overflow from oversized inputs.
Mandates timely remediation of the identified buffer overflow flaw in TOTOLINK A7000R firmware up to 9.1.0u.6115 via patching or updates.
Implements memory protections such as stack canaries and non-executable memory to block exploitation of the stack-based buffer overflow even if input validation fails.