{"id":"CVE-2026-116508","kind":"vulnerability","aliases":["CVE-2026-116508"],"related":[],"title":"TOTOLINK A950RG router: stack overflow in infostat.cgi lets remote attackers run code","description":"A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument CONTENT_LENGTH results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.","summary":"The TOTOLINK A950RG router firmware has a stack-based buffer overflow in the Device-Information CGI handler sub_402340 in infostat.cgi, triggered through a manipulated CONTENT_LENGTH value. A remote attacker can send a crafted request to overwrite the stack, which typically leads to crashing the device or running attacker-chosen code on it; a public exploit has been released.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firmware","infrastructure","iot","routers","totolink","web-management"],"not_affected_if":["management-not-exposed","other-router-models","remote-management-disabled"],"how_to_check":"- Check the firmware version on the device web admin page or in the system info; the affected build is `4.1.2cu.5268_B20221104`.\n- Check whether the router's web management interface is reachable from the internet or untrusted networks, and whether `infostat.cgi` responds to requests from outside.","fix":"- unknown: the sources do not name a patched firmware version or vendor fix.\n- Restrict access to the router's web management interface to trusted LAN addresses, and disable remote management from the WAN side.\n- Replace the device or apply a vendor firmware update when one is published.","status":"open","published_at":"2026-10-26T22:16:54+00:00","first_seen_at":"2026-10-26T22:25:33+00:00","triaged_at":"2026-10-26T22:27:31+00:00","updated_at":"2026-10-26T22:27:31+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T22:27:31Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a patched firmware version or vendor fix.\n- Restrict access to the router's web management interface to trusted LAN addresses, and disable remote management from the WAN side.\n- Replace the device or apply a vendor firmware update when one is published.","reach":"internet","title":"TOTOLINK A950RG router: stack overflow in infostat.cgi lets remote attackers run code","impact":"high","summary":"The TOTOLINK A950RG router firmware has a stack-based buffer overflow in the Device-Information CGI handler sub_402340 in infostat.cgi, triggered through a manipulated CONTENT_LENGTH value. A remote attacker can send a crafted request to overwrite the stack, which typically leads to crashing the device or running attacker-chosen code on it; a public exploit has been released.","category":"infrastructure","nicknames":[],"who_cares":["totolink","routers","iot","firmware","web-management"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the router and can intercept or redirect traffic.","analyst_note":"Find the vendor advisory or a firmware fix for TOTOLINK A950RG, and confirm whether the infostat.cgi endpoint requires login, using the NVD entry linked in the sources.","how_to_check":"- Check the firmware version on the device web admin page or in the system info; the affected build is `4.1.2cu.5268_B20221104`.\n- Check whether the router's web management interface is reachable from the internet or untrusted networks, and whether `infostat.cgi` responds to requests from outside.","needs_analyst":true,"not_affected_if":["other-router-models","remote-management-disabled","management-not-exposed"],"who_is_affected":"Owners of TOTOLINK A950RG routers running firmware `4.1.2cu.5268_B20221104`, especially those with the web management interface reachable from the internet or from untrusted networks. Teams not running this model can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000696,"input_tokens":3365,"output_tokens":719,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-116508':15A,18A '-2026':14A,17A '4.1.2':99C '402340':47B,109C 'a950rg':2A,29B,98C 'affect':101C 'argument':126C 'attack':10A,59B,79B,140C,156C 'attacker-chosen':78B 'base':36B,133C 'buffer':37B,134C 'cgi':44B,120C 'chosen':80B 'code':12A,81B 'compon':116C 'content':54B,127C 'craft':63B 'crash':73B 'cu.5268_b20221104':100C 'cve':13A,16A 'devic':42B,75B,118C 'device-inform':41B,117C 'discov':95C 'exploit':86B,137C,144C 'file':112C 'firmwar':19B,31B 'flaw':92C 'function':107C 'handler':45B 'inform':43B,119C 'infostat.cgi':7A,49B,113C 'infrastructur':20B 'iot':21B 'issu':104C 'lead':71B 'length':55B,128C 'let':8A 'manag':26B 'manipul':53B,123C 'may':152C 'overflow':5A,38B,135C 'overwrit':66B 'perform':121C 'possibl':142C 'public':85B,150C 'releas':89B,147C 'remot':9A,58B,136C 'request':64B 'result':129C 'router':3A,22B,30B 'run':11A,77B 'secur':91C 'send':61B 'stack':4A,35B,68B,132C 'stack-bas':34B,131C 'sub':46B,108C 'totolink':1A,23B,28B,97C 'trigger':50B 'typic':70B 'use':154C 'valu':56B 'web':25B 'web-manag':24B","nicknames":[],"mitigations":[],"who_affected":"Owners of TOTOLINK A950RG routers running firmware `4.1.2cu.5268_B20221104`, especially those with the web management interface reachable from the internet or from untrusted networks. Teams not running this model can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116508","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116508","severity":null,"published_at":"2026-10-26T22:16:54+00:00","modified_at":"2026-10-26T22:16:54+00:00","first_seen_at":"2026-10-26T22:25:33+00:00","fetched_at":"2026-10-26T22:25:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}