TOTOlink A3600R v5.9c.4959 contains a buffer overflow vulnerability in the setAppEasyWizardConfig interface of /lib/cste_modules/app.so. The vulnerability occurs because the rootSsid parameter is not properly validated for length, allowing remote attackers to trigger a buffer overflow, potentially leading to arbitrary code execution or denial of service.
References
| Link | Resource |
|---|---|
| https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3600R/rootSsid-setAppEasyWizardConfig.md | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
07 Apr 2026, 12:10
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3600R/rootSsid-setAppEasyWizardConfig.md - Exploit, Third Party Advisory | |
| First Time |
Totolink
Totolink a3600r Firmware Totolink a3600r |
|
| CPE | cpe:2.3:o:totolink:a3600r_firmware:5.9c.4959:*:*:*:*:*:*:* cpe:2.3:h:totolink:a3600r:-:*:*:*:*:*:*:* |
01 Apr 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | CWE-120 |
01 Apr 2026, 16:23
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-01 16:23
Updated : 2026-04-07 12:10
NVD link : CVE-2026-31027
Mitre link : CVE-2026-31027
CVE.ORG link : CVE-2026-31027
JSON object : View
Products Affected
totolink
- a3600r
- a3600r_firmware
CWE
CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')