Cyber Posture

CVE-2026-1686

HighPublic PoC

Published: 30 January 2026

Published
30 January 2026
Modified
10 February 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0017 38.0th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A security flaw has been discovered in Totolink A3600R 5.9c.4959. This issue affects the function setAppEasyWizardConfig in the library /lib/cste_modules/app.so. Performing a manipulation of the argument apcliSsid results in buffer overflow. It is possible to initiate the attack remotely. The…

more

exploit has been released to the public and may be used for attacks.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly prevents buffer overflow by requiring validation and bounds checking on the apcliSsid input argument in setAppEasyWizardConfig.

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and remediation of the specific buffer overflow flaw via firmware patching or upgrades.

SI-16 Memory Protection good match
prevent

Implements memory protections such as stack canaries, ASLR, and DEP to block exploitation of the buffer overflow even if triggered.

Security SummaryAI

CVE-2026-1686 is a buffer overflow vulnerability affecting the Totolink A3600R router on firmware version 5.9c.4959. The issue resides in the setAppEasyWizardConfig function within the /lib/cste_modules/app.so library, where manipulation of the apcliSsid argument triggers the overflow. Associated with CWE-119 and CWE-120, it was published on 2026-01-30 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

An attacker with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Exploitation results in high impacts to confidentiality, integrity, and availability, potentially enabling arbitrary code execution on the device. A proof-of-concept exploit has been publicly released.

Advisories referenced on VulDB and a GitHub repository detail the vulnerability and provide exploit code, but no specific patches or mitigation steps are outlined in the available information.

Details

CWE(s)
CWE-119CWE-120

Affected Products

totolink
a3600r firmware
5.9c.4959

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Buffer overflow in router's configuration function enables remote arbitrary code execution from low privileges, directly facilitating public-facing application exploitation (T1190) and privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References