CVE-2026-19811
published 2026-08-14CVE-2026-19811: A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the function setIpQosRules of the file…
PriorityP270high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.85%
58.0th percentile
A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument Comment results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| totolink | a800r | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vendor_redhat4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
TOTOLINK A800R 4.1.2cu.5137_B20200730 firewall.so /cgi-bin/cstecgi.cgi setIpQosRules Comment stack-based overflow
vuldb·2026-08-14
CVE-2026-19811 [CRITICAL] TOTOLINK A800R 4.1.2cu.5137_B20200730 firewall.so /cgi-bin/cstecgi.cgi setIpQosRules Comment stack-based overflow
A vulnerability was found in TOTOLINK A800R 4.1.2cu.5137_B20200730 and classified as critical. The impacted element is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument Comment results in stack-based buffer overflow.
This vulnerability is identified as CVE-2026-19811. The attack can be executed remotely. Additionally, an exploit exists.
GHSA
A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730.
ghsa_unreviewed·2026-08-14
CVE-2026-19811 [HIGH] CWE-119 A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730.
A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument Comment results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Red Hat
kernel: nvme: fix command effects log lifetime for multipath heads
vendor_redhat·2026-10-18·CVSS 4.4
CVE-2026-98814 [MEDIUM] CWE-825 kernel: nvme: fix command effects log lifetime for multipath heads
kernel: nvme: fix command effects log lifetime for multipath heads
In the Linux kernel, the following vulnerability has been resolved:
nvme: fix command effects log lifetime for multipath heads
KASAN reported a use-after-free when an I/O passthrough command was sent
through a multipath namespace head after the controller path that first
created the head had been removed:
BUG: KASAN: slab-use-after-free in nvme_command_effects+0x192/0x200 [nvme_core]
Read of size 4 at addr ffff888141b14400 by task nvme/19811
nvme_command_effects+0x192/0x200 [nvme_core]
nvme_cmd_allowed+0x7e/0x1b0 [nvme_core]
nvme_user_cmd.constprop.0+0x1b5/0x450 [nvme_core]
nvme_ns_head_chr_ioctl+0xf4/0x2a0 [nvme_core]
Move the log cache to the subsystem, with one entry per command set. Both
controllers and namespace heads
No detection rules found.
No public exploits indexed.
2026-08-14
Published