CVE-2026-82539 TOTOLINK A720R MAC Filtering cstecgi.cgi setMacFilterRules memory corruption
Remote attackers can trigger memory corruption in TOTOLINK A720R routers via the MAC filtering interface, potentially leading to code execution or service disruption.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82539?
CVE-2026-82539 is a critical memory corruption vulnerability in TOTOLINK A720R, published on 30 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability was determined in TOTOLINK A720R 4.1.5cu.630_B20250509. This impacts the function setMacFilterRules of the file cstecgi.cgi of the component MAC Filtering. Executing a manipulation of the argument desc can lead to memory corruption. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Weakness: CWE-119
Which versions are affected by CVE-2026-82539?
How do I fix CVE-2026-82539?
No fix has been published for CVE-2026-82539 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-82539 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82539 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-54f9-jfc2-qh3v.