CVE-2026-75012

Name of the Vulnerable Software and Affected Versions TOTOLINK EX1200L version 9.3.5u.6146 B20201023

Description A remote attack can be initiated against the Password Configuration Handler component. The issue exists in the setPasswordCfg() function within the '/cgi-bin/cstecgi.cgi' endpoint, where manipulation leads to a null pointer dereference. A null pointer dereference occurs when a program attempts to read or write to a memory address that is null, typically causing the application to crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/cgi-bin/cstecgi.cgi' endpoint to minimize the risk of exploitation.