---
id: "CVE-2026-121598"
kind: "vulnerability"
aliases: ["CVE-2026-121598"]
title: "TOTOLINK A950RG router: remote stack overflow in wireless config handler"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "A950RG", "fixed": [], "affected": "4.1.2cu.5268_B20221104", "ecosystem": "vendor"}]
ecosystems: []
tags: ["a950rg", "home-router", "infrastructure", "totolink", "wireless"]
not_affected_if: ["admin-not-exposed", "other-models"]
published_at: "2026-11-04T01:17:23+00:00"
first_seen_at: "2026-11-04T01:45:48+00:00"
updated_at: "2026-11-04T01:47:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121598", "first_seen_at": "2026-11-04T01:45:48+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T01:47:39+00:00"}]
---

# TOTOLINK A950RG router: remote stack overflow in wireless config handler

The TOTOLINK A950RG router firmware copies the wepkey argument of its wireless configuration CGI into a fixed stack buffer without a length check. A remote attacker can overflow that buffer, which can let them run code on the router, and the exploit has been published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:A950RG affected 4.1.2cu.5268_B20221104 fixed ?

## How to check

- Log in to the router admin page and read the firmware version; 4.1.2cu.5268_B20221104 is the version named as vulnerable.
- Check whether the web admin interface is reachable from the internet (WAN/remote management setting); if so, turn it off.
- The CNA vector (PR:L) indicates a low-privileged login is needed; not confirmed from a vendor page.

## Timeline

- 2026-11-04T01:45:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121598
- 2026-11-04T01:47:39+00:00 analyst — No TOTOLINK advisory or fixed firmware found (vendor download page not informative); NVD page unreadable via web-cli. CNA VulDB vector has PR:L so login likely needed, secondary source OffSeq only. Public exploit per CVE text. Nothing marked verified; fix_status left as is since no vendor page to link.

## Documents

- [describes] OffSeq: CVE-2026-121598 TOTOLINK A950RG https://radar.offseq.com/threat/cve-2026-121598-stack-based-buffer-overflow-in-totolink-a950rg-01009a0dda735fae

## From the sources

A security vulnerability has been detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function strcpy of the file /cgi-bin/cstecgi.cgi of the component Basic Wireless Configuration Handler. The manipulation of the argument wepkey leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_