SOHO Routers, October 2026: 6 Critical CVEs With Public Exploits in TOTOLINK, Tenda and D-Link Gear

On October 21 and 22, 2026, NVD received six critical CVEs covering five consumer networking devices from three vendors: TOTOLINK, Tenda and D-Link. All six were filed by VulDB as CNA, and every description states that the exploit has been published.

The pattern is familiar by now: one specific firmware build, one web interface handler that copies a parameter without checking it, one proof of concept on GitHub. The models change from batch to batch. What never changes is the lack of a fixed version in the NVD data.

Every score comes from VulDB. NVD has marked these entries Deferred, which means NIST will not analyze them and no CPE configuration is attached. None is in the CISA KEV catalog at the time of writing.

TOTOLINK A950RG — CVE-2026-114575

Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0)

The UploadCustomModule function in lib/cste_modules/product.so passes the FileMd5 parameter into a system command without neutralizing it. Anyone who can reach the interface can inject their own commands, and the published vector says no authentication is needed.

The function name gives the game away: a field meant to carry an MD5 hash, a fixed-length hex string, is never validated as one. That is the single most common flaw in this class of firmware.

TOTOLINK EX200 — CVE-2026-114383 and CVE-2026-114382

Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0) for both

Two stack overflows behind the same entry point, /cgi-bin/cstecgi.cgi, in two different modules:

• CVE-2026-114383: setWiFiAclAddConfig in wireless.so, via the macAddress parameter;
• CVE-2026-114382: setStaticDhcpConfig in lan.so, via the Comment parameter.

The EX200 is a Wi-Fi range extender, the kind of box that gets plugged into a hallway socket once and forgotten, firmware updates included.

The cstecgi.cgi handler keeps coming back in TOTOLINK advisories; see also the 30 Talos CVEs on the X2000R, published a few days earlier.

Tenda AC19 — CVE-2026-113744

Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0)

A stack overflow in formSetFirewallCfg (/goform/SetFirewallCfg) in the httpd web management service, through the firewallEn parameter. Yes, the way in is the form that configures the device's own firewall.

Tenda BE3L Pro — CVE-2026-114268

Vector: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.9)

A buffer overflow in formWifiBasicSet (/goform/WifiBasicSet) via the security_5g parameter. The one real difference in this batch: the vector says PR:L, so an authenticated session on the interface is required. On consumer routers, that often just means knowing the admin password, sometimes the factory one.

D-Link DHP-W610AV — CVE-2026-113736

Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8)

No memory corruption here. According to NVD, the default configuration file etc/defnodes/defaultvalue.xml sets an empty password, which the login_prepare_hnap function accepts during HNAP login. The GitHub reference ships a login script that uses it.

The DHP-W610AV is a powerline adapter with Wi-Fi. An empty password in the factory configuration means any unit that was never reconfigured can be administered by whoever reaches its interface.

What this means in practice

The first five are all web form parameters copied without length or content checks. On these firmwares the web server usually runs with full system privileges, so code execution through the interface effectively hands over the whole device. That is what the S:C (scope changed) in the VulDB vectors expresses.

Real-world exposure hinges on something the vectors do not tell you: is the admin interface reachable from the internet? If it is LAN-only, an attacker needs a foothold on the local network first, or a web page that gets a user's browser to send requests to the router.

Public exploits, old firmware (the A950RG build dates from November 2022, judging by its name), no announced fix: these devices are natural recruits for router botnets. That is an inference, not something NVD reports; none of these entries documents exploitation.

Affected versions

NVD provides no CPE configuration and no fixed version for any of the six. Each description names a single firmware build (the "Firmware named" column above). Other versions are not cleared by that; they simply were not tested.

Check each model's support page at TOTOLINK, Tenda and D-Link. An end-of-life device will most likely never get a fix.

Detection

• Inventory: look for these models across your network, including branch offices, remote workers' homes and meeting rooms.
• Exposure: make sure no admin interface answers from the internet (remote management HTTP/HTTPS ports).
• Suspicious requests in whatever logs exist: /cgi-bin/cstecgi.cgi (TOTOLINK), /goform/SetFirewallCfg or /goform/WifiBasicSet (Tenda) with abnormally long parameters or shell metacharacters.
• Behavior: unexpected outbound traffic from the device, changed DNS settings, unexplained reboots.

Mitigation

1. Turn off remote administration on every one of these devices.
2. D-Link DHP-W610AV: set a strong admin password now.
3. Replace factory passwords everywhere, especially on the Tenda BE3L Pro (authenticated flaw).
4. Isolate devices that cannot be updated in a separate segment with no path to workstations or servers.
5. Retire models with no fixed firmware. A consumer router has no place on a business network.

Why continuous monitoring of your network gear matters

These six CVEs will never be analyzed by NIST and never be tied to a CPE, so monitoring that relies only on CPE matching will not see them. You also have to search by product name.

With cveo.tech, list your routers, extenders and powerline adapters by exact model and get an alert as soon as a CVE names them, even when NVD has not analyzed it.