{"id":"CVE-2026-121598","kind":"vulnerability","aliases":["CVE-2026-121598"],"related":[],"title":"TOTOLINK A950RG router: remote stack overflow in wireless config handler","description":"A security vulnerability has been detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function strcpy of the file /cgi-bin/cstecgi.cgi of the component Basic Wireless Configuration Handler. The manipulation of the argument wepkey leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.","summary":"The TOTOLINK A950RG router firmware copies the wepkey argument of its wireless configuration CGI into a fixed stack buffer without a length check. A remote attacker can overflow that buffer, which can let them run code on the router, and the exploit has been published.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"A950RG","fixed":[],"affected":"4.1.2cu.5268_B20221104","ecosystem":"vendor"}],"ecosystems":[],"tags":["a950rg","home-router","infrastructure","totolink","wireless"],"not_affected_if":["admin-not-exposed","other-models"],"how_to_check":"- Log in to the router admin page and read the firmware version; 4.1.2cu.5268_B20221104 is the version named as vulnerable.\n- Check whether the web admin interface is reachable from the internet (WAN/remote management setting); if so, turn it off.\n- The CNA vector (PR:L) indicates a low-privileged login is needed; not confirmed from a vendor page.","fix":null,"status":"open","published_at":"2026-11-04T01:17:23+00:00","first_seen_at":"2026-11-04T01:45:48+00:00","triaged_at":"2026-11-04T01:46:18+00:00","updated_at":"2026-11-04T01:47:39+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-04T01:46:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"TOTOLINK A950RG router: remote stack overflow in wireless config handler","impact":"high","summary":"The TOTOLINK A950RG router firmware copies the wepkey argument of its wireless configuration CGI into a fixed stack buffer without a length check. A remote attacker can overflow that buffer, which can let them run code on the router, and the exploit has been published.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["totolink","a950rg","home-router","wireless"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs code on the router with remote access","analyst_note":"Confirm the fix status and whether the admin interface needs login at https://nvd.nist.gov/vuln/detail/CVE-2026-121598 and vendor advisories.","how_to_check":"- Check the router's firmware version in its admin page and compare it with `4.1.2cu.5268_B20221104`\n- Check whether the router's web admin interface is reachable from the internet (unknown from sources)","plain_action":"If you own a TOTOLINK A950RG router, check with TOTOLINK for a firmware update and turn off remote access to its admin page until one is installed.","needs_analyst":true,"not_affected_if":["other-models","admin-not-exposed"],"who_is_affected":"The flaw is in the TOTOLINK A950RG firmware version 4.1.2cu.5268_B20221104, in the /cgi-bin/cstecgi.cgi handler that sets wireless configuration. The sources describe remote triggering, so routers whose web admin interface is reachable from the internet or an untrusted network are the main concern. Other TOTOLINK models and firmware versions are not stated to be affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000747,"input_tokens":4175,"output_tokens":659,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fix status and whether the admin interface needs login at https://nvd.nist.gov/vuln/detail/CVE-2026-121598 and vendor advisories.","search":"'-121598':13A,16A '-2026':12A,15A '/cgi-bin/cstecgi.cgi':89C '4.1.2':79C 'a950rg':2A,17A,18B,27B,78C 'argument':33B,101C 'attack':50B,116C 'base':107C 'basic':93C 'buffer':43B,54B,108C 'cgi':38B 'check':47B 'code':60B 'compon':92C 'config':9A 'configur':37B,95C 'copi':30B 'cu.5268_b20221104':80C 'cve':11A,14A 'detect':75C 'disclos':122C 'exploit':66B,119C 'file':88C 'firmwar':29B 'fix':41B 'function':84C 'handler':10A,96C 'home':20B 'home-rout':19B 'impact':82C 'infrastructur':22B 'initi':114C 'lead':103C 'length':46B 'let':57B 'manipul':98C 'may':125C 'overflow':6A,52B,109C 'possibl':112C 'public':123C 'publish':69B 'remot':4A,49B,117C 'router':3A,21B,28B,63B 'run':59B 'secur':71C 'stack':5A,42B,106C 'stack-bas':105C 'strcpi':85C 'totolink':1A,23B,26B,77C 'use':127C 'vulner':72C 'wepkey':32B,102C 'wireless':8A,24B,36B,94C 'without':44B","nicknames":[],"mitigations":[],"who_affected":"The flaw is in the TOTOLINK A950RG firmware version 4.1.2cu.5268_B20221104, in the /cgi-bin/cstecgi.cgi handler that sets wireless configuration. The sources describe remote triggering, so routers whose web admin interface is reachable from the internet or an untrusted network are the main concern. Other TOTOLINK models and firmware versions are not stated to be affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a TOTOLINK A950RG router, check with TOTOLINK for a firmware update and turn off remote access to its admin page until one is installed.","pkeys":["a950rg"],"ptokens":["a950rg"],"labels":["a950rg","critical","homerouter","infrastructure","totolink","wireless"],"campaign_type":null,"first_public_at":"2026-11-04T01:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121598","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121598","severity":null,"published_at":"2026-11-04T01:17:23+00:00","modified_at":"2026-11-04T01:17:23+00:00","first_seen_at":"2026-11-04T01:45:48+00:00","fetched_at":"2026-11-04T01:45:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121598:1616","url":null,"severity":null,"published_at":"2026-11-04T01:47:39+00:00","modified_at":"2026-11-04T01:47:39+00:00","first_seen_at":"2026-11-04T01:47:39+00:00","fetched_at":"2026-11-04T01:47:39+00:00","note":"No TOTOLINK advisory or fixed firmware found (vendor download page not informative); NVD page unreadable via web-cli. CNA VulDB vector has PR:L so login likely needed, secondary source OffSeq only. Public exploit per CVE text. Nothing marked verified; fix_status left as is since no vendor page to link."}],"documents":[{"id":62945,"url":"https://radar.offseq.com/threat/cve-2026-121598-stack-based-buffer-overflow-in-totolink-a950rg-01009a0dda735fae","title":"OffSeq: CVE-2026-121598 TOTOLINK A950RG","kind":"other","source":"analyst","publisher":null,"text":"CVSS 4.0 9.4 / 3.1 9.9 by CNA VulDB; vector PR:L (low privileges required); public exploit available.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}