---
id: "CVE-2026-116508"
kind: "vulnerability"
aliases: ["CVE-2026-116508"]
title: "TOTOLINK A950RG router: stack overflow in infostat.cgi lets remote attackers run code"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["firmware", "infrastructure", "iot", "routers", "totolink", "web-management"]
not_affected_if: ["management-not-exposed", "other-router-models", "remote-management-disabled"]
published_at: "2026-10-26T22:16:54+00:00"
first_seen_at: "2026-10-26T22:25:33+00:00"
updated_at: "2026-10-26T22:27:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116508", "first_seen_at": "2026-10-26T22:25:33+00:00"}]
---

# TOTOLINK A950RG router: stack overflow in infostat.cgi lets remote attackers run code

The TOTOLINK A950RG router firmware has a stack-based buffer overflow in the Device-Information CGI handler sub_402340 in infostat.cgi, triggered through a manipulated CONTENT_LENGTH value. A remote attacker can send a crafted request to overwrite the stack, which typically leads to crashing the device or running attacker-chosen code on it; a public exploit has been released.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the firmware version on the device web admin page or in the system info; the affected build is `4.1.2cu.5268_B20221104`.
- Check whether the router's web management interface is reachable from the internet or untrusted networks, and whether `infostat.cgi` responds to requests from outside.

## Fix

- unknown: the sources do not name a patched firmware version or vendor fix.
- Restrict access to the router's web management interface to trusted LAN addresses, and disable remote management from the WAN side.
- Replace the device or apply a vendor firmware update when one is published.

## Timeline

- 2026-10-26T22:25:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116508

## From the sources

A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument CONTENT_LENGTH results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_