TOTOLINK A950RG EUVD-2026-116669

Exploitation requires network reachability to the device's web management interface (/cgi-bin/cstecgi.cgi) AND a valid low-privileged authenticated session, consistent with PR:L - it is NOT unauthenticated. The specific trigger is a request to the setMacFilterRules function of the MAC Filter Handler with an overlong 'addEffect' argument. Limiting factors: authentication is needed; the management interface is typically bound to the LAN rather than the WAN by default, so remote Internet exploitation generally depends on exposed/remote-management configurations or an existing internal foothold. The analysis applies to firmware A950RG 4.1.2cu.5268_B20221104 as reported; other versions are unverified.

Signals are mixed and point to a real but not top-tier priority. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw that nonetheless requires PR:L - a low-privileged authenticated session - so this is not a pre-auth internet-wide threat. The vulnerability class (CWE-121 stack-based buffer overflow reached through the setMacFilterRules handler) with full high impact (VC:H/VI:H/VA:H) is consistent with attacker control of the device. Exploit maturity is E:P (Proof-of-Concept), and the input provides a public PoC reference (a GitHub gist) that is NOT verified as working exploit code, so this should be treated as 'a public PoC reference exists; it is not verified as working exploit code' rather than confirmed weaponization. There is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_week', not act_now/emergency. Net: a credible, publicly-documented authenticated RCE/DoS in a SOHO router warranting patching on a near-term cadence, not an emergency, with the authentication requirement and consumer-grade footprint being the main factors tempering real-world risk. Key missing data: no EPSS, no KEV, no independent vendor advisory, and PoC not validated as functional.

An attacker who has obtained a low-privileged authenticated session to the A950RG web management interface (for example via default/weak credentials or an already-compromised LAN foothold) sends a crafted POST to /cgi-bin/cstecgi.cgi invoking setMacFilterRules with an oversized 'addEffect' argument, overflowing a stack buffer in the MAC Filter Handler. Successful exploitation can crash the service or lead to execution of attacker-controlled code on the router. A public PoC reference exists but is not verified as working exploit code, so reliability of code execution versus simple denial of service is unconfirmed.