Live › vulnerability › CVE-2026-121598
The TOTOLINK A950RG router firmware copies the wepkey argument of its wireless configuration CGI into a fixed stack buffer without a length check. A remote attacker can overflow that buffer, which can let them run code on the router, and the exploit has been published.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 01:45 UTC. All times on this page are UTC.
The flaw is in the TOTOLINK A950RG firmware version 4.1.2cu.5268_B20221104, in the /cgi-bin/cstecgi.cgi handler that sets wireless configuration. The sources describe remote triggering, so routers whose web admin interface is reachable from the internet or an untrusted network are the main concern. Other TOTOLINK models and firmware versions are not stated to be affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| A950RG | vendor | 4.1.2cu.5268_B20221104 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function strcpy of the file /cgi-bin/cstecgi.cgi of the component Basic Wireless Configuration Handler. The manipulation of the argument wepkey leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
This page as .md · .json · in your agent: get_signal("CVE-2026-121598")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.