{"id":"CVE-2026-121599","kind":"vulnerability","aliases":["CVE-2026-121599"],"related":[],"title":"TOTOLINK A950RG router: remote stack overflow via Wi-Fi multi-SSID settings","description":"A vulnerability was detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function setWiFiMultipleConfig/delWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi of the component Multi-SSID Configuration. The manipulation of the argument wepkey2/wepkey3 results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.","summary":"The TOTOLINK A950RG router firmware has a stack-based buffer overflow in the Multi-SSID Wi-Fi configuration handler of /cgi-bin/cstecgi.cgi, triggered through the wepkey2 and wepkey3 arguments. A remote attacker can likely run code on the router, and a public exploit is reported.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["a950rg","embedded","home-router","infrastructure","totolink"],"not_affected_if":["admin-not-exposed","other-hardware"],"how_to_check":"- Check the firmware version on the router's admin page and compare it with `4.1.2cu.5268_B20221104`\n- Check whether the router's web admin interface is reachable from the internet\n- Check whether the Multi-SSID configuration is in use","fix":null,"status":"open","published_at":"2026-11-04T01:17:23+00:00","first_seen_at":"2026-11-04T01:45:48+00:00","triaged_at":"2026-11-04T01:46:18+00:00","updated_at":"2026-11-04T01:46:18+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-04T01:46:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"TOTOLINK A950RG router: remote stack overflow via Wi-Fi multi-SSID settings","impact":"high","summary":"The TOTOLINK A950RG router firmware has a stack-based buffer overflow in the Multi-SSID Wi-Fi configuration handler of /cgi-bin/cstecgi.cgi, triggered through the wepkey2 and wepkey3 arguments. A remote attacker can likely run code on the router, and a public exploit is reported.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["totolink","a950rg","home-router","embedded"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs code on the router remotely","analyst_note":"Sources do not state a fixed firmware version or whether authentication is required; check the NVD entry and vendor advisories for details.","how_to_check":"- Check the firmware version on the router's admin page and compare it with `4.1.2cu.5268_B20221104`\n- Check whether the router's web admin interface is reachable from the internet\n- Check whether the Multi-SSID configuration is in use","plain_action":"If you own a TOTOLINK A950RG router, check with TOTOLINK for a firmware update and do not expose its admin page to the internet.","needs_analyst":true,"not_affected_if":["other-hardware","admin-not-exposed"],"who_is_affected":"Only the TOTOLINK A950RG router with firmware 4.1.2cu.5268_B20221104 is named in the source. The flaw is reached through the router's web management CGI over the network, so devices whose admin interface is exposed to untrusted networks are the main concern. Teams that do not run this device can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000747,"input_tokens":4189,"output_tokens":656,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources do not state a fixed firmware version or whether authentication is required; check the NVD entry and vendor advisories for details.","search":"'-121599':17A,20A '-2026':16A,19A '/cgi-bin/cstecgi.cgi':51B,92C '4.1.2':82C 'a950rg':2A,21B,30B,81C 'affect':84C 'argument':58B,104C 'attack':61B,119C 'base':37B,110C 'buffer':38B,111C 'code':65B 'compon':95C 'configur':48B,99C 'cu.5268_b20221104':83C 'cve':15A,18A 'detect':78C 'embed':22B 'exploit':72B,122C 'fi':10A,47B 'file':91C 'firmwar':32B 'function':87C 'handler':49B 'home':24B 'home-rout':23B 'infrastructur':26B 'launch':117C 'like':63B 'manipul':101C 'may':127C 'multi':12A,43B,97C 'multi-ssid':11A,42B,96C 'overflow':6A,39B,112C 'possibl':115C 'public':71B,125C 'remot':4A,60B,120C 'report':74B 'result':106C 'router':3A,25B,31B,68B 'run':64B 'set':14A 'setwifimultipleconfig/delwifimultipleconfig':88C 'ssid':13A,44B,98C 'stack':5A,36B,109C 'stack-bas':35B,108C 'totolink':1A,27B,29B,80C 'trigger':52B 'use':129C 'via':7A 'vulner':76C 'wepkey2':55B 'wepkey2/wepkey3':105C 'wepkey3':57B 'wi':9A,46B 'wi-fi':8A,45B","nicknames":[],"mitigations":[],"who_affected":"Only the TOTOLINK A950RG router with firmware 4.1.2cu.5268_B20221104 is named in the source. The flaw is reached through the router's web management CGI over the network, so devices whose admin interface is exposed to untrusted networks are the main concern. Teams that do not run this device can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a TOTOLINK A950RG router, check with TOTOLINK for a firmware update and do not expose its admin page to the internet.","pkeys":[],"ptokens":[],"labels":["a950rg","critical","embedded","homerouter","infrastructure","totolink"],"campaign_type":null,"first_public_at":"2026-11-04T01:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121599","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121599","severity":null,"published_at":"2026-11-04T01:17:23+00:00","modified_at":"2026-11-04T01:17:23+00:00","first_seen_at":"2026-11-04T01:45:48+00:00","fetched_at":"2026-11-04T01:45:48+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}