TOTOLINK Products Buffer Overflow Vulnerability in CloudACMunualUpdate Function

A critical buffer overflow vulnerability has been identified in several TOTOLINK router models, including the T10, A3100R, A950RG, A800R, N600R, A3000RU, and A810R, all running firmware version 4.1.8cu.5241_B20210927. The vulnerability arises in the CloudACMunualUpdate function within the file cstecgi.cgi, where improper handling of the FileName argument allows for remote exploitation.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly result in arbitrary code execution or causing the device to crash.