Medium severity · published Aug 17, 2026
CVE-2026-75012
TOTOLINK EX1200L Password Configuration cstecgi.cgi setPasswordCfg null pointer dereference
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
A security vulnerability has been detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. Affected by this issue is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Password Configuration Handler. The manipulation leads to null pointer dereference. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EX
EX1200L · TOTOLINK
9.3.5u.6146_B20201023 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-75012
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-75012
gist.github.com
https://gist.github.com/wyxstarry/afdc067090575c216a9d2622c3338e5c
vuldb.com
https://vuldb.com/cve/CVE-2026-75012
vuldb.com
https://vuldb.com/submit/876022
vuldb.com
https://vuldb.com/vuln/391272
vuldb.com
https://vuldb.com/vuln/391272/cti
www.totolink.net
https://www.totolink.net/
More from EX1200L
9.4
CVE-2026-44089
Buffer Overflow in Totolink EX1200L router
6.5
CVE-2026-75013
TOTOLINK EX1200L cstecgi.cgi setWizardCfg null pointer dereference