TOTOLINK A950RG CVE-2026-116508

The attacker must be able to send an HTTP request to the router's Device-Information CGI endpoint (infostat.cgi) and supply a manipulated CONTENT_LENGTH value that overflows a stack buffer in sub_402340; per the supplied CVSS vector (PR:N/UI:N) no authentication or user interaction is required. Practical limiting factors: the attacker needs network reachability to the router's web service - on typical SOHO deployments the management interface is LAN-only, so remote (WAN-side) exploitation realistically requires that remote/web management be exposed to the internet, which is non-default on most units. Exploitation is also constrained to the specific affected firmware (4.1.2cu.5268_B20221104) on the A950RG model. The precise overflow trigger beyond CONTENT_LENGTH manipulation is not described in the available sources.

Severity signals are strongly aligned at the high end: the input CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with High impact across confidentiality, integrity and availability (9.3), and the vuln.today Decision label is act_now, so urgency is elevated by the decision framework itself. However, exploitation-probability signals are more modest and should temper how this is prioritized: EPSS is only 0.61% (49th percentile), the CVE is NOT listed in CISA KEV, and the PoC is a reference only, not verified as working exploit code. This is the key tension - the CVSS/Decision signals say 'critical, act now' while EPSS and the absence of KEV indicate no confirmed widespread or active exploitation yet. The act_now label is driven primarily by the unauthenticated-remote, fully-impacting vector plus a public PoC reference, not by observed in-the-wild activity. Net: a genuinely serious flaw on reachable devices, but the real-world footprint is limited by product prevalence (a specific consumer router model) and by the fact that these routers are typically not internet-facing unless remote management is enabled. Treat as high-priority patching for exposed/managed TOTOLINK A950RG units, but note the exploitation evidence is a PoC reference, not confirmed active exploitation.

A remote attacker who can reach the router's web interface sends a crafted HTTP request to infostat.cgi (Device-Information CGI) with a manipulated CONTENT_LENGTH value, overflowing a stack buffer in sub_402340. Given the CVSS vector (AV:N/AC:L/PR:N/UI:N), this requires no authentication or user interaction and low complexity. A public PoC reference exists (a gist) but it is not verified as working exploit code, so weaponized reliability is unconfirmed.