Zero Radar
← feed
CriticalVulnerabilityCVE-2026-114383updated 25 Oct 2026, 16:35 UTC

TOTOLINK EX200 Wi-Fi extender can be crashed or taken over via a crafted MAC address

Attackers on your network can send a specially crafted request to this Wi-Fi range extender, which can overwrite memory on the device. This can let them crash it or potentially run their own commands on it.

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?Not knownNo attacks reported so far
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerSends a crafted request from the network
  2. 2Web interfaceRequest reaches cstecgi.cgi on the device
  3. 3Wireless ACL handlermacAddress value is copied without length checks
  4. 4Stack overflowMemory beyond the buffer is overwritten
  5. ResultDevice crashes or attacker gains control

What happened

A stack-based buffer overflow exists in the setWiFiAclAddConfig function of /cgi-bin/cstecgi.cgi in the wireless.so component of TOTOLINK EX200 firmware 5.2.3c.7200, triggered by an overly long macAddress argument. The attack can be launched remotely.

Why it is dangerous: Successful exploitation could let an attacker take control of the device or disrupt the Wi-Fi network it provides. Anyone running this extender on their network is at risk, especially if its management interface is reachable from untrusted networks.

Are you affected?

You are affected if you run TOTOLINK EX200 with firmware 5.2.3c.7200.

TOTOLINK EX200 5.2.3c.7200

What to do

  1. Check whether your TOTOLINK EX200 runs firmware 5.2.3c.7200 and look for an official firmware update from TOTOLINK
  2. Install the newest firmware as soon as the vendor releases a fix
  3. Disable remote management and block access to the device's web interface from the internet until it is patched
  4. If no fix is available, consider replacing the device or isolating it on a separate network

Timeline

  1. 21 Oct 2026, 22:16 UTC
    Publicly disclosed
  2. 21 Oct 2026, 22:16 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 16:35 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-114383 · GHSA-5mwr-gvhc-9w4r
CVSS
9.3 / 10
EPSS
0.7% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 22:16 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 16:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

TOTOLINK EX200 Wi-Fi extender can be crashed or taken over via a crafted MAC address · Zero Radar