TOTOLINK A950RG
CVE-2026-121598
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface over network
-
DeliveryAuthenticate with low-privilege credentials
-
ExploitSend oversized wepkey to cstecgi.cgi
-
ExecutionOverflow stack buffer in strcpy
-
ImpactExecute code / crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the A950RG web management interface and low-privilege authentication (PR:L) sufficient to reach the Basic Wireless Configuration Handler, then submission of an overlong 'wepkey' argument to /cgi-bin/cstecgi.cgi. Limiting factors: authenticated access is required (not an anonymous internet bug), the target must be the specific firmware 4.1.2cu.5268_B20221104, and the management interface must be reachable from the attacker (typically LAN-side unless remote administration is exposed). No user interaction is needed (UI:N). |
| Impact | This is a moderate-priority issue rather than a top-tier emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw, but PR:L means exploitation requires at least low-privilege authenticated access to the TOTOLINK A950RG management interface, which meaningfully narrows the realistic attacker population compared to a fully unauthenticated bug. The vuln.today Decision label is 'this_week' (not act_now/emergency) and the CVSS 4.0 exploit maturity is E:P (proof-of-concept), consistent with the PoC being a reference only. There is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation - the signals point to a credible but not yet weaponized issue. Note a tension in the source vector: it marks subsequent-system impact as high (SC:H/SI:H/SA:H), which inflates the score, yet a stack overflow in the device's own CGI handler would normally compromise only the vulnerable device itself; treat the subsequent-system impact as unverified. Overall: real and worth patching this week, but gated by authentication and lacking confirmed in-the-wild use. |
| Exploit ScenarioDerived | An attacker with access to the router's web interface and low-privilege credentials sends a crafted request to /cgi-bin/cstecgi.cgi setting an overlong 'wepkey' value in the Basic Wireless Configuration Handler, overflowing a stack buffer passed to strcpy. A public PoC reference exists (a gist) but is not verified as working exploit code, so reliable remote code execution would likely require additional development. Successful exploitation could crash the device or execute attacker-controlled code with the CGI process's privileges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Nov 04, 2026
Stack-based buffer overflow in the TOTOLINK A950RG Basic Wireless Configuration Handler (firmware 4.1.2cu.5268_B20221104) allows remote attackers with low-privilege authentication to corrupt memory by submitting an overlong 'wepkey' value to /cgi-bin/cstecgi.cgi, with high confidentiality, integrity, and availability impact assessed. Exploitation requires network reachability to the router's web management interface and authenticated access sufficient to reach the handler; no user interaction is needed. A public PoC reference exists but is not verified as working exploit code, no CISA KEV listing is indicated, and the issue is assessed as this_week priority rather than an emergency.
Earlier versions of this analysis (1)
Stack-based buffer overflow in the TOTOLINK A950RG wireless router, specifically firmware build 4.1.2cu.5268_B20221104, where the Basic Wireless Configuration Handler in /cgi-bin/cstecgi.cgi copies the user-supplied wepkey argument with strcpy into a fixed-size stack buffer without bounds checking. Network-reachable attackers who hold valid low-privilege credentials (PR:L - not fully unauthenticated) can send a crafted request that overflows the buffer and, per the assessed CVSS 3.1 vector, achieve high confidentiality, integrity and availability impact on the device. Severity is rated Critical (CVSS 4.0 score 9.4; independently assessed 8.8-equivalent CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and the vuln.today decision label is act_now; a public PoC reference (GitHub Gist) exists but is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation. Practical exposure is constrained by the need for valid low-level credentials and by default deployments typically limiting the management interface to the LAN.
RemediationAI
No vendor-released patch is identified in the available data. Until an update is published, restrict access to the A950RG web management interface: disable WAN-side or remote administration and limit /cgi-bin/cstecgi.cgi to trusted LAN hosts or management VLANs, accepting reduced remote-management convenience. Because exploitation requires low-privilege authentication, change default administrative credentials and remove unnecessary accounts; this lowers exposure but does not fix the overflow. Monitor VulDB (https://vuldb.com/vuln/430440) and the vendor site (https://www.totolink.net/) for a firmware update, and replace the device if it must be internet-facing.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a stack-based buffer overflow (CWE-121) in the Basic Wireless Configuration Handler of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104. The handler passes the user-supplied 'wepkey' argument to strcpy in /cgi-bin/cstecgi.cgi without bounds checking, so an overlong value can overwrite stack memory. The CPE entry cpe:2.3:a:totolink:a950rg:*:*:*:*:*:*:*:* identifies the A950RG product line without version constraints, while the reported affected build is 4.1.2cu.5268_B20221104. The assessed vector requires network access and low-privilege authentication (PR:L) to reach the configuration handler; the trigger is submission of the overlong wepkey argument to the CGI endpoint.
Know when A950Rg gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Network-reachable CGI handler with low attacker complexity but requires authenticated low-privilege access (PR:L); overflow yields code execution on the device, so C/I/A High and scope unchanged.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function strcpy of the file /cgi-bin/cstecgi.cgi of the component Basic Wireless Configuration Handler. The manipulation of the argument wepkey leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Executive ViewAI
The TOTOLINK A950RG wireless router, widely used in small office and remote access scenarios, contains a high-severity stack buffer overflow (CVE-2026-121598) that authenticated attackers can exploit to compromise memory. This puts sensitive data, network integrity, and service availability at risk for any organization relying on this device. Leadership should prioritize immediate mitigation because exploitation requires only low-privilege access to the router's web interface, which is often exposed to the internet or poorly segmented.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict access to the web management interface to trusted networks, disable remote management, enforce strong authentication, segment the device on a dedicated VLAN, and monitor for anomalous requests to /cgi-bin/cstecgi.cgi; consider replacing the device if risk cannot be adequately mitigated.
Threat Intelligence Overview
NVD
CVE.org
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Affected Products (CPE)CVE.org
Stack-based buffer overflow in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 affects the Device-Information CGI handle
Command injection in the device-information handler of the TOTOLINK A950RG router (firmware 4.1.2cu.5268_B20221104) allo
Command injection in the Cloud Upgrade component of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 allows a remote atta
Stack-based buffer overflow in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 lets a remote, low-privileged authenticat
A stack-based buffer overflow in the Multi-SSID Configuration handler of the TOTOLINK A950RG wireless router (firmware 4
A stack-based buffer overflow in the Easy Setup Wizard handler of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 lets r
Information disclosure in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 allows remote, unauthenticated attackers to re
Least-privilege violation across multiple TOTOLINK SOHO router models (A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R
Exploit-DB