Live › vulnerability › CVE-2026-121597
The TOTOLINK A950RG router firmware has a stack-based buffer overflow in the Easy Setup Wizard handler, reached through the functionType argument of setAppEasyWizardConfig in /cgi-bin/cstecgi.cgi. A remote attacker can send a crafted request to overwrite memory, which can lead to code execution on the device; a public exploit has been released.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Affects the TOTOLINK A950RG router running firmware 4.1.2cu.5268_B20221104. The flaw is in the web setup wizard endpoint, so exposure depends on whether that management interface can be reached from untrusted networks. Devices where the admin interface is only reachable from a trusted LAN carry less risk, though the sources do not say how the device is normally deployed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| A950RG firmware | vendor | 4.1.2cu.5268_B20221104 | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setAppEasyWizardConfig of the file /cgi-bin/cstecgi.cgi of the component Easy Setup Wizard Handler. Executing a manipulation of the argument functionType can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-121597")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.