{"id":"CVE-2026-121597","kind":"vulnerability","aliases":["CVE-2026-121597"],"related":[],"title":"TOTOLINK A950RG router: stack overflow in setup wizard lets remote attackers in","description":"A weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setAppEasyWizardConfig of the file /cgi-bin/cstecgi.cgi of the component Easy Setup Wizard Handler. Executing a manipulation of the argument functionType can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.","summary":"The TOTOLINK A950RG router firmware has a stack-based buffer overflow in the Easy Setup Wizard handler, reached through the functionType argument of setAppEasyWizardConfig in /cgi-bin/cstecgi.cgi. A remote attacker can send a crafted request to overwrite memory, which can lead to code execution on the device; a public exploit has been released.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"A950RG firmware","fixed":[],"affected":"4.1.2cu.5268_B20221104","ecosystem":"vendor"}],"ecosystems":[],"tags":["a950rg","firmware","infrastructure","iot","routers","totolink"],"not_affected_if":["admin-interface-lan-only","other-firmware-version"],"how_to_check":"- Log in to the router admin page and read the firmware version under system status; the version named in the CVE is 4.1.2cu.5268_B20221104.\n- Check whether the web management interface answers from the internet (WAN address, ports 80/443); if so, turn off remote management.\n- Authentication requirement is not stated: the CVSS vector lists PR:L (low privileges), so assume a login may be needed but do not rely on it.\n- No vendor patch page was found; check totolink.net downloads for the A950RG for newer firmware than 4.1.2cu.5268_B20221104.","fix":null,"status":"open","published_at":"2026-11-04T00:17:27+00:00","first_seen_at":"2026-11-04T00:46:18+00:00","triaged_at":"2026-11-04T00:47:34+00:00","updated_at":"2026-11-04T00:50:33+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-04T00:47:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"TOTOLINK A950RG router: stack overflow in setup wizard lets remote attackers in","impact":"high","summary":"The TOTOLINK A950RG router firmware has a stack-based buffer overflow in the Easy Setup Wizard handler, reached through the functionType argument of setAppEasyWizardConfig in /cgi-bin/cstecgi.cgi. A remote attacker can send a crafted request to overwrite memory, which can lead to code execution on the device; a public exploit has been released.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["totolink","a950rg","routers","firmware","iot"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker runs code on the router via memory corruption.","analyst_note":"Sources do not state a vendor fix or whether authentication is required; check the NVD entry and TOTOLINK's advisories for a patched firmware version.","how_to_check":"- Log in to the router admin page and note the firmware version shown under system status; affected version is `4.1.2cu.5268_B20221104`.\n- Check whether the router's web management interface is reachable from the internet, for example by testing the WAN address on port 80 or 443.\n- Look for a `/cgi-bin/cstecgi.cgi` endpoint on the device from outside the local network.","plain_action":"","needs_analyst":true,"not_affected_if":["admin-interface-lan-only","other-firmware-version"],"who_is_affected":"Affects the TOTOLINK A950RG router running firmware `4.1.2cu.5268_B20221104`. The flaw is in the web setup wizard endpoint, so exposure depends on whether that management interface can be reached from untrusted networks. Devices where the admin interface is only reachable from a trusted LAN carry less risk, though the sources do not say how the device is normally deployed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000772,"input_tokens":4176,"output_tokens":708,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources do not state a vendor fix or whether authentication is required; check the NVD entry and TOTOLINK's advisories for a patched firmware version.","search":"'-121597':14A,17A '-2026':13A,16A '/cgi-bin/cstecgi.cgi':52B,97C '4.1.2':87C 'a950rg':2A,18A,20B,28B,86C 'affect':90C 'argument':48B,110C 'attack':11A,55B,121C,141C 'avail':132C 'base':35B,117C 'buffer':36B,118C 'code':68B 'compon':100C 'could':137C 'craft':59B 'cu.5268_b20221104':88C 'cve':12A,15A 'devic':72B 'easi':40B,101C 'execut':69B,105C 'exploit':75B,128C 'file':96C 'firmwar':21B,30B 'firmware':19A 'function':92C 'functiontyp':47B,111C 'handler':43B,104C 'identifi':83C 'infrastructur':22B 'iot':23B 'lead':66B,113C 'let':9A 'made':131C 'manipul':107C 'may':122C 'memori':63B 'overflow':5A,37B,119C 'overwrit':62B 'perform':124C 'public':74B,135C 'reach':44B 'releas':78B 'remot':10A,54B,126C 'request':60B 'router':3A,24B,29B 'send':57B 'setappeasywizardconfig':50B,93C 'setup':7A,41B,102C 'stack':4A,34B,116C 'stack-bas':33B,115C 'totolink':1A,25B,27B,85C 'use':139C 'weak':80C 'wizard':8A,42B,103C","nicknames":[],"mitigations":[],"who_affected":"Affects the TOTOLINK A950RG router running firmware `4.1.2cu.5268_B20221104`. The flaw is in the web setup wizard endpoint, so exposure depends on whether that management interface can be reached from untrusted networks. Devices where the admin interface is only reachable from a trusted LAN carry less risk, though the sources do not say how the device is normally deployed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["a950rgfirmware","firmware"],"ptokens":["a950rg","firmware"],"labels":["a950rg","critical","firmware","infrastructure","iot","routers","totolink"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121597","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121597","severity":null,"published_at":"2026-11-04T00:17:27+00:00","modified_at":"2026-11-04T00:17:27+00:00","first_seen_at":"2026-11-04T00:46:18+00:00","fetched_at":"2026-11-04T00:46:18+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121597:1596","url":null,"severity":null,"published_at":"2026-11-04T00:50:33+00:00","modified_at":"2026-11-04T00:50:33+00:00","first_seen_at":"2026-11-04T00:50:33+00:00","fetched_at":"2026-11-04T00:50:33+00:00","note":"Only NVD/VulDB-derived data found (CVSS 4.0 vector PR:L, public exploit per description). No TOTOLINK advisory or fixed firmware found, no PoC link found for this CVE, X not checked. Same firmware build has several other recent A950RG CVEs (e.g. CVE-2026-116504/116506/116508). Fix left unknown, nothing verified."}],"documents":[{"id":62161,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121597","title":"NVD CVE-2026-121597","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}