TOTOLINK A950RG EUVD-2026-110468

Exploitation targets the getLanguageCfg function in global.so on the TOTOLINK A950RG (firmware 4.1.2cu.5268_B20221104) by manipulating the 'token' argument in a request to the device. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), this is remote and unauthenticated against the affected firmware with no user interaction required, so the main limiting factor is network reachability of the router's management interface (typically LAN-side, or WAN-side only where remote management is exposed). The flaw is tied to this specific model and firmware build, which limits the affected population; the available sources do not describe how the token manipulation produces the disclosure, so the exact precondition within the request is not confirmed.

This is a moderate-severity information disclosure flaw (CWE-200) in the getLanguageCfg function of global.so on the TOTOLINK A950RG router, with a vendor CVSS 4.0 base score of 5.5 driven by AV:N/AC:L/AT:N/PR:N/UI:N and a limited confidentiality impact (VC:L, VI:N, VA:N). The signals are internally consistent and point to a real-but-not-critical issue: network-reachable and low-complexity with no privileges or user interaction required, yet the impact is bounded to partial information disclosure rather than code execution or integrity loss. EPSS is low at 0.40% (34th percentile), and the vulnerability is NOT on the CISA KEV list, so there is no confirmation of active exploitation; the SSVC framework lists Exploitation as 'poc' (not active), Automatable 'yes', and Technical Impact 'partial', which aligns with a public PoC reference rather than observed attacks. The vuln.today decision label is 'this_month', indicating a scheduled-remediation priority rather than an emergency. The low EPSS combined with a PoC reference suggests opportunistic or research-stage interest rather than widespread exploitation. One limitation to note: the description does not explain the mechanism by which manipulating the 'token' argument produces disclosure, so the exact nature and sensitivity of the leaked data is not established in the available sources.

A remote attacker with network access to the router's web/management interface sends a crafted request invoking the getLanguageCfg function with a manipulated 'token' argument, causing the device to return information it should not disclose. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is needed against a default configuration. A public PoC reference exists (a GitHub gist), though it is not verified as working exploit code.