EIP-2026-101508

PRE-CVE

4 TOTOLINK Router Models - Cross-Site Request Forgery / Cross-Site Scripting

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-101508. PoCs published by Pierre Kim.

AI-analyzed exploit summary This exploit demonstrates CSRF and XSS vulnerabilities in multiple TOTOLINK router models, allowing attackers to modify router configurations (e.g., DNS settings, remote management) via crafted HTML forms. The PoC includes bypass techniques for anti-CSRF protections.

Description

4 TOTOLINK Router Models - Cross-Site Request Forgery / Cross-Site Scripting

Exploits (1)

exploitdb WORKING POC
by Pierre Kim · textwebappshardware
https://www.exploit-db.com/exploits/37624

This exploit demonstrates CSRF and XSS vulnerabilities in multiple TOTOLINK router models, allowing attackers to modify router configurations (e.g., DNS settings, remote management) via crafted HTML forms. The PoC includes bypass techniques for anti-CSRF protections.

Classification
Working Poc 90%
Attack Type
Xss | Csrf
Complexity
Trivial
Reliability
Reliable
Target: TOTOLINK iPuppy (1.2.1), iPuppy3 (1.0.2), N100RE-V1 (V1.1-B20140723-2-432-EN), N200RE (V1.4-B20140724-2-457-EN)
No auth needed
Prerequisites: Victim must visit a malicious webpage while on the same LAN as the vulnerable router
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026