TOTOLINK A720R Router: Unauthenticated Memory Corruption RCE (CVE-2026-82539)

Executive Summary

CVE-2026-82539 affects the TOTOLINK A720R wireless router running firmware 4.1.5cu.630_B20250509. The flaw is a memory corruption vulnerability in the setMacFilterRules function of cstecgi.cgi, the CGI handler backing the router's MAC Filtering component. A remote attacker can trigger the flaw by manipulating the desc argument passed to this endpoint.

CVSS Score: 9.4 (Critical) — CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

The vulnerability was assigned by VulDB, reserved August 29, 2026, and published August 30, 2026. A proof-of-concept exploit is already public on GitHub, so this should be treated as actively exploitable.

Vulnerability Overview

Affected Versions

Technical Details

cstecgi.cgi is the CGI executable that backs much of TOTOLINK's web-management interface on embedded router firmware — a common pattern across the TOTOLINK product line and one that has produced a string of related findings, including stack-based overflows in the same setMacFilterRules handler on other models such as the A800R (CVE-2026-19813).

In the A720R, setMacFilterRules() processes the desc argument of a MAC filtering rule without adequate bounds validation. A specially crafted value in this field corrupts memory during processing, which can be leveraged for denial of service or, depending on the layout of the corrupted memory, remote code execution on the device.

Attack Vector

1. Attacker identifies a reachable TOTOLINK A720R running firmware
   4.1.5cu.630_B20250509
2. Attacker sends a crafted request to cstecgi.cgi invoking
   setMacFilterRules with a malicious desc argument
3. The handler processes the argument without sufficient bounds
   checking, corrupting adjacent memory
4. Depending on exploitation technique, this crashes the device
   or grants the attacker code execution on the router

Although the published CVSS vector lists privileges required as High, TOTOLINK devices in this product family have a history of weak default credentials and exposed management interfaces, which meaningfully lowers the real-world bar for exploitation on unhardened deployments.

Impact of Successful Exploitation

Immediate Remediation

Step 1: Check for a Patched Firmware Release

No fixed firmware version has been published in the public record at the time of writing. Check TOTOLINK's official support and download pages directly for the A720R model, and apply any update addressing setMacFilterRules or cstecgi.cgi as soon as it becomes available.

Step 2: Restrict Management Access

Disable remote (WAN-facing) administration on the device, and restrict access to the management interface to trusted LAN hosts only.

Step 3: Change Default Credentials

Confirm the router is not using default or weak administrator credentials — several prior TOTOLINK vulnerabilities have been chained with weak-credential access to reach vulnerable CGI endpoints.

Step 4: Consider Replacement

TOTOLINK's consumer router line has accumulated a large number of CGI memory-corruption findings across models. If patching is not available promptly, organizations relying on this device for perimeter or critical network functions should evaluate replacing it with actively maintained hardware.

Detection Indicators

Post-Remediation Steps

1. Apply the vendor firmware patch as soon as TOTOLINK publishes one for the A720R.
2. Audit MAC filtering and other CGI-managed settings for unauthorized changes.
3. Disable WAN-side management if not strictly required.
4. Monitor for the public PoC being weaponized in mass-scanning campaigns, consistent with prior TOTOLINK CGI vulnerabilities.

References

• OffSeq Threat Radar — CVE-2026-82539: Memory Corruption in TOTOLINK A720R
• NVD — CVE-2026-82539