CVE-2026-75013

Name of the Vulnerable Software and Affected Versions TOTOLINK EX1200L version 9.3.5u.6146 B20201023

Description A remote attack can be launched against the /cgi-bin/cstecgi.cgi endpoint by manipulating the setWizardCfg() function, leading to a null pointer dereference. A null pointer dereference occurs when a program attempts to read from or write to a memory address that is null, typically causing the application to crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /cgi-bin/cstecgi.cgi endpoint to minimize the risk of exploitation.