EUVD-2026-116646
GHSA-698g-8986-jr2x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web management interface
-
DeliveryAuthenticate with low-privilege access
-
ExploitSend crafted request to cstecgi.cgi setAppEasyWizardConfig
-
ExecutionOverflow stack buffer via functionType
-
ImpactExecute code or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reach to the router's web management interface and the ability to invoke the setAppEasyWizardConfig function in /cgi-bin/cstecgi.cgi (the Easy Setup Wizard Handler) with a manipulated functionType argument. The supplied CVSS vector carries PR:L, indicating low-privilege authentication is needed, so the attacker must hold valid low-level credentials or an authenticated session to the device; this is the primary limiting factor and should be verified, since the description does not itself state an authentication requirement. No user interaction is required (UI:N) and attack complexity is low (AC:L), but exposure is constrained to environments where the management interface is reachable by the attacker (e.g., LAN, or WAN if the interface is exposed) on the affected firmware A950RG 4.1.2cu.5268_B20221104. |
| Impact | Signals are moderately aligned toward a real but not emergency-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with high confidentiality, integrity and availability impact drives the 8.6 base score, indicating a remotely reachable, low-complexity flaw that nonetheless requires some privilege (PR:L). Exploit maturity is E:P (Proof-of-Concept), and the input provides a PoC reference that is not verified as working exploit code, so this is not confirmed weaponized tooling. The vuln.today Decision label is 'this_week', consistent with a serious issue warranting prompt attention rather than drop-everything response. There is no CISA KEV listing and no EPSS value supplied, so widespread or confirmed active exploitation cannot be asserted. The main tension is PR:L versus the fact that many TOTOLINK cstecgi.cgi endpoints have historically been unauthenticated; the supplied vector says authenticated (PR:L), and the description does not state the authentication requirement, so this should be verified against the device's actual access control for the Easy Setup Wizard handler. |
| Exploit ScenarioDerived | An attacker with network reach to the router's web management interface and low-level credentials sends a crafted request to /cgi-bin/cstecgi.cgi invoking setAppEasyWizardConfig with a manipulated functionType argument, overflowing a stack buffer (CWE-121). With AC:L and no user interaction, this can corrupt the stack to crash the service or potentially execute attacker-controlled code on the device. A public PoC reference exists but is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 04, 2026
A stack-based buffer overflow in the Easy Setup Wizard handler of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 lets remote attackers corrupt memory by sending a manipulated functionType argument to setAppEasyWizardConfig in /cgi-bin/cstecgi.cgi, with high impact on confidentiality, integrity and availability. The supplied CVSS vector carries PR:L, so the attacker must hold valid low-privilege credentials or an authenticated session against the device's web management interface, and the interface must be network-reachable (LAN, or WAN where exposed). A public PoC reference exists but is not verified as working exploit code, and no CISA KEV entry indicates active exploitation; priority is assessed as this_week rather than emergency tier.
RemediationAI
No vendor-released patch or fixed firmware version is identified in the available sources, so there is no confirmed upgrade target to cite; administrators should monitor https://www.totolink.net/ and the VulDB entry https://vuldb.com/vuln/430439 for a firmware update. Because authentication requirements carry PR:L, rotate any default or weak administrative credentials first - this removes the easiest path to an authenticated session but does not fix the underlying overflow. Next, cut off reachability to the web management interface: disable WAN/remote management and block inbound access to /cgi-bin/cstecgi.cgi at the perimeter, accepting that this breaks legitimate remote administration, and restrict the UI to a trusted management VLAN or specific source IPs, which limits exposure but requires network re-segmentation. Where the wizard is not needed, avoid using the Easy Setup Wizard flow and prefer manual configuration, understanding that this only reduces the attack surface and is not a guaranteed barrier. Watch device logs for anomalous requests to cstecgi.cgi with oversized functionType values as a detection compensating control, noting that it depends on the firmware exposing usable logs.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-121, a stack-based buffer overflow, in the CGI binary cstecgi.cgi that backs the device's web management UI. The Easy Setup Wizard handler function setAppEasyWizardConfig takes a functionType argument from the HTTP request and processes it without adequate bounds checking, so an oversized value can overwrite stack memory in the CGI process context. Because CGI handlers run with the privileges of the embedded web server, a successful overflow can subvert the management plane entirely, which is why the assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - network-reachable, low complexity, no user interaction, but gated on low-privilege authentication. The CPE string cpe:2.3:a:totolink:a950rg:*:*:*:*:*:*:*:* uses a wildcard version, so it does not by itself bound the affected release set; the only firmware explicitly named in the source data is 4.1.2cu.5268_B20221104, and the trigger conditions for other builds are not described in the available sources. The report originates from VulDB and includes a gist reference that is a PoC reference, not confirmed working exploit code.
Know when A950Rg gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Remotely reachable CGI endpoint (AV:N, AC:L) requiring low-privilege authentication per the supplied vector (PR:L), no user interaction, yielding device code execution with full C/I/A impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setAppEasyWizardConfig of the file /cgi-bin/cstecgi.cgi of the component Easy Setup Wizard Handler. Executing a manipulation of the argument functionType can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Executive ViewAI
A high-severity memory corruption vulnerability affects TOTOLINK A950RG routers, enabling authenticated attackers to potentially disrupt or compromise network operations. Leadership should prioritize remediation to prevent unauthorized access and service outages, particularly if these devices are deployed in critical network segments.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting management interface access to trusted networks, enforcing strong authentication, and monitoring for exploitation indicators.
Threat Intelligence Overview
NVD
CVE.org
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 affects the Device-Information CGI handle
Command injection in the device-information handler of the TOTOLINK A950RG router (firmware 4.1.2cu.5268_B20221104) allo
Command injection in the Cloud Upgrade component of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 allows a remote atta
Stack-based buffer overflow in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 lets a remote, low-privileged authenticat
A stack-based buffer overflow in the Multi-SSID Configuration handler of the TOTOLINK A950RG wireless router (firmware 4
Stack-based buffer overflow in the TOTOLINK A950RG Basic Wireless Configuration Handler (firmware 4.1.2cu.5268_B20221104
Information disclosure in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 allows remote, unauthenticated attackers to re
Least-privilege violation across multiple TOTOLINK SOHO router models (A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R
Exploit-DB