{"id":"CVE-2026-114382","published":"2026-10-21T22:16:48Z","modified":"2026-10-28T02:17:06Z","title":"A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200","vendor":"TOTOLINK","product":"EX200","tier":"core","eol":null,"description":{"text":"A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. The manipulation of the argument Comment results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.","provenance":"source","from":"NVD"},"summary":{"text":"A stack-based buffer overflow exists in the setStaticDhcpConfig function of /cgi-bin/cstecgi.cgi, part of the lan.so component in TOTOLINK EX200 firmware 5.2.3c.7200, triggered by improperly bounded input to the Comment argument. An attacker can exploit it remotely, without authentication or user interaction, by sending a crafted request to the device's web interface.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:17:27Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00667,"percentile":0.51839,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":6,"pulses":[{"name":"Known_Cve | Oct 30, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ae35d8e6ee9e838fd042498","created":"2026-10-29"},{"name":"Known_Cve | Oct 29, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ae20c290cecfbc79bd84822","created":"2026-10-28"},{"name":"Known_Cve | Oct 28, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ae0ba8e2d29f6aa1bfe6f11","created":"2026-10-27"},{"name":"Known_Cve | Oct 27, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6adf68c4585d98c8d3af5bea","created":"2026-10-26"},{"name":"Known_Cve | Oct 24, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6adb7421f0eaee440740fbf3","created":"2026-10-23"},{"name":"Known_Cve | Oct 23, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6ada23844cb3f14c39a33102","created":"2026-10-22"}],"provenance":"machine"},"cwes":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"},{"id":"CWE-121","name":"Stack-based Buffer Overflow"}],"references":[{"url":"https://github.com/qwq-nm/CVE/blob/f5d61361eb7d846479f6d76c0aa4273e9af46d27/CVE1/report.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-114382","tags":[]},{"url":"https://vuldb.com/submit/1019881","tags":[]},{"url":"https://vuldb.com/vuln/424741","tags":[]},{"url":"https://vuldb.com/vuln/424741/cti","tags":[]},{"url":"https://www.totolink.net/","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-107579","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107579","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-21","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114382","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":19.3,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":10.37,"detail":"percentile 0.5184"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.92,"detail":"6 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}