{"id":"CVE-2026-121600","kind":"vulnerability","aliases":["CVE-2026-121600"],"related":[],"title":"TOTOLINK A950RG router: remote stack overflow in MAC filter handler","description":"A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component MAC Filter Handler. This manipulation of the argument addEffect causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.","summary":"The TOTOLINK A950RG router firmware has a stack-based buffer overflow in the setMacFilterRules function of its web CGI interface, triggered through the addEffect argument. A public exploit exists, so a remote attacker could likely run code on the router.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"A950RG firmware","fixed":[],"affected":"4.1.2cu.5268_B20221104","ecosystem":"vendor"}],"ecosystems":[],"tags":["a950rg","embedded-firmware","home-router","infrastructure","totolink"],"not_affected_if":["admin-interface-not-reachable","other-firmware-version"],"how_to_check":"- Log in to the router admin page and read the firmware version; the affected build is 4.1.2cu.5268_B20221104\n- Check whether the admin interface (port 80) is reachable from the internet or untrusted networks, and turn off remote management if so\n- Also check other TOTOLINK models and builds you run; sibling handlers in the same cstecgi.cgi have had similar reports","fix":null,"status":"open","published_at":"2026-11-04T01:17:23+00:00","first_seen_at":"2026-11-04T01:45:48+00:00","triaged_at":"2026-11-04T01:46:18+00:00","updated_at":"2026-11-04T01:47:42+00:00","category":"infrastructure","confidence":0.55,"triage":{"at":"2026-11-04T01:46:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"TOTOLINK A950RG router: remote stack overflow in MAC filter handler","impact":"high","summary":"The TOTOLINK A950RG router firmware has a stack-based buffer overflow in the setMacFilterRules function of its web CGI interface, triggered through the addEffect argument. A public exploit exists, so a remote attacker could likely run code on the router.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["totolink","a950rg","home-router","embedded-firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker runs code on the router","analyst_note":"Find out whether TOTOLINK has released a fixed firmware and whether the CGI requires authentication; the sources give neither.","how_to_check":"- Check the firmware version on the router admin page; the affected build is `4.1.2cu.5268_B20221104`\n- Confirm whether the router's web admin interface is reachable from the internet or untrusted networks\n- unknown for other checks: the sources do not describe a configuration file or command to inspect","plain_action":"If you own a TOTOLINK A950RG router, check its firmware version and keep its admin page off the internet until the vendor publishes a fix.","needs_analyst":true,"not_affected_if":["other-firmware-version","admin-interface-not-reachable"],"who_is_affected":"Owners of TOTOLINK A950RG routers running firmware `4.1.2cu.5268_B20221104`, where the web management CGI at /cgi-bin/cstecgi.cgi is reachable. Exposure depends on whether the admin interface can be reached from untrusted networks, which the sources do not confirm. Devices not running this firmware build are not covered by the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000749,"input_tokens":4163,"output_tokens":665,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find out whether TOTOLINK has released a fixed firmware and whether the CGI requires authentication; the sources give neither.","search":"'-121600':13A,16A '-2026':12A,15A '/cgi-bin/cstecgi.cgi':90C '4.1.2':77C 'a950rg':2A,17A,19B,30B,76C 'addeffect':52B,102C 'affect':79C 'argument':53B,101C 'attack':61B,110C 'base':37B,106C 'buffer':38B,107C 'caus':103C 'cgi':47B 'code':65B 'compon':93C 'could':62B 'cu.5268_b20221104':78C 'cve':11A,14A 'embed':21B 'embedded-firmwar':20B 'exist':57B 'exploit':56B,116C 'file':89C 'filter':9A,95C 'firmwar':22B,32B 'firmware':18A 'flaw':70C 'found':73C 'function':43B,85C 'handler':10A,96C 'home':24B 'home-rout':23B 'infrastructur':26B 'initi':113C 'interfac':48B 'like':63B 'mac':8A,94C 'manipul':98C 'may':121C 'overflow':6A,39B,108C 'public':55B 'publish':119C 'remot':4A,60B,114C 'router':3A,25B,31B,68B 'run':64B 'setmacfilterrul':42B,86C 'stack':5A,36B,105C 'stack-bas':35B,104C 'totolink':1A,27B,29B,75C 'trigger':49B 'use':123C 'vulner':82C 'web':46B","nicknames":[],"mitigations":[],"who_affected":"Owners of TOTOLINK A950RG routers running firmware 4.1.2cu.5268_B20221104 are affected. The flaw is in the setMacFilterRules handler of /cgi-bin/cstecgi.cgi (addEffect argument). The CVSS vector from VulDB lists low privileges required, so a login to the admin interface is likely needed, but no source states this. Routers whose admin page is not reachable from untrusted networks, or on other firmware builds (not covered by the sources), are at lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a TOTOLINK A950RG router, check its firmware version and keep its admin page off the internet until the vendor publishes a fix.","pkeys":["a950rgfirmware","firmware"],"ptokens":["a950rg","firmware"],"labels":["a950rg","critical","embeddedfirmware","homerouter","infrastructure","totolink"],"campaign_type":null,"first_public_at":"2026-11-04T01:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121600","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121600","severity":null,"published_at":"2026-11-04T01:17:23+00:00","modified_at":"2026-11-04T01:17:23+00:00","first_seen_at":"2026-11-04T01:45:48+00:00","fetched_at":"2026-11-04T01:45:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121600:1614","url":null,"severity":null,"published_at":"2026-11-04T01:47:42+00:00","modified_at":"2026-11-04T01:47:42+00:00","first_seen_at":"2026-11-04T01:47:42+00:00","fetched_at":"2026-11-04T01:47:42+00:00","note":"Only NVD/VulDB-derived record found; no TOTOLINK advisory or fixed firmware located, no public PoC page found for this CVE (so poc_count stays 0). CVSS 4.0 vector from VulDB has PR:L, suggesting login is needed, but not confirmed by any source. Nothing marked verified."}],"documents":[{"id":62946,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121600","title":"NVD CVE-2026-121600","kind":"advisory","source":"analyst","publisher":null,"text":"A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Function setMacFilterRules of /cgi-bin/cstecgi.cgi (MAC Filter Handler); manipulating argument addEffect causes stack-based buffer overflow. Remote attack possible. Exploit published. CNA: VulDB; CVSS 4.0 vector PR:L.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}