Live › vulnerability › CVE-2026-121599
The TOTOLINK A950RG router firmware has a stack-based buffer overflow in the Multi-SSID Wi-Fi configuration handler of /cgi-bin/cstecgi.cgi, triggered through the wepkey2 and wepkey3 arguments. A remote attacker can likely run code on the router, and a public exploit is reported.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 01:45 UTC. All times on this page are UTC.
Only the TOTOLINK A950RG router with firmware 4.1.2cu.5268_B20221104 is named in the source. The flaw is reached through the router's web management CGI over the network, so devices whose admin interface is exposed to untrusted networks are the main concern. Teams that do not run this device can skip it.
No product ranges from the sources yet.
4.1.2cu.5268_B20221104No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function setWiFiMultipleConfig/delWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi of the component Multi-SSID Configuration. The manipulation of the argument wepkey2/wepkey3 results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.
This page as .md · .json · in your agent: get_signal("CVE-2026-121599")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.