CVE-2026-121597
CriticalCVSS 9.9Summary
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the setAppEasyWizardConfig function in /cgi-bin/cstecgi.cgi mishandles the functionType argument, leading to a stack-based buffer overflow. The attack can be performed remotely and a public exploit is available.
Risk Assessment
The stack-based buffer overflow may enable remote code execution or device instability. Public exploit availability increases the risk of active exploitation.
Recommendation
Update the device firmware to a patched version or restrict access to the management interface. Consider disabling the vulnerable setup wizard function.
Other vulnerabilities in TOTOLINK A950RG
See all- CVE-2026-116508Critical
TOTOLINK A950RG 4.1.2cu.5268_B20221104 contains a stack-based buffer overflow in function sub_402340 of infostat.cgi (Device-Information CGI component). Manipulating the CONTENT_LENGTH argument causes overflow, and the exploit is publicly available.
- CVE-2026-116506Critical
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the apmib_set function in firewall.so is vulnerable to command injection. The vulnerability can be exploited remotely, and a public exploit is available.
- CVE-2026-116505Critical
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the getDeviceInfo function in /var/lib/misc/udhcpd.leases is vulnerable to command injection via manipulation of the MAC address argument. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-116504Critical
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the setCloudUpgradeFW function in lib/cste_modules/upgrade.so is vulnerable to command injection via manipulation of the FileName argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-114575Critical
In TOTOLINK A950RG 4.1.2cu.5268_B20221104, the UploadCustomModule function in lib/cste_modules/product.so is vulnerable to command injection via manipulation of the FileMd5 argument. The attack can be launched remotely, and the exploit has been published and may be used.
- CVE-2026-116507Medium
In TOTOLINK A950RG 4.1.2cu.5268_B20221104, the getLanguageCfg function in global.so discloses information when the token argument is manipulated. The attack may be launched remotely, and the exploit is publicly available.
Original NVD description (English source)
A weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setAppEasyWizardConfig of the file /cgi-bin/cstecgi.cgi of the component Easy Setup Wizard Handler. Executing a manipulation of the argument functionType can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS