Live › vulnerability › CVE-2026-121600
The TOTOLINK A950RG router firmware has a stack-based buffer overflow in the setMacFilterRules function of its web CGI interface, triggered through the addEffect argument. A public exploit exists, so a remote attacker could likely run code on the router.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 01:45 UTC. All times on this page are UTC.
Owners of TOTOLINK A950RG routers running firmware 4.1.2cu.5268_B20221104 are affected. The flaw is in the setMacFilterRules handler of /cgi-bin/cstecgi.cgi (addEffect argument). The CVSS vector from VulDB lists low privileges required, so a login to the admin interface is likely needed, but no source states this. Routers whose admin page is not reachable from untrusted networks, or on other firmware builds (not covered by the sources), are at lower risk.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| A950RG firmware | vendor | 4.1.2cu.5268_B20221104 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component MAC Filter Handler. This manipulation of the argument addEffect causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.
This page as .md · .json · in your agent: get_signal("CVE-2026-121600")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.