A950Rg
Monthly
Stack-based buffer overflow in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 lets a remote, low-privileged authenticated user trigger memory corruption by supplying an overlong addEffect argument to the setMacFilterRules function in /cgi-bin/cstecgi.cgi. Successful exploitation can produce high confidentiality, integrity, and availability impact, but the device's web management interface is typically LAN-bound, so Internet exploitation generally requires exposed remote management or an internal foothold. A public PoC reference exists; it is not verified as working exploit code, and no active exploitation is confirmed.
A stack-based buffer overflow in the Multi-SSID Configuration handler of the TOTOLINK A950RG wireless router (firmware 4.1.2cu.5268_B20221104) lets an attacker who is logged in to the web management interface corrupt memory by sending an oversized wepkey2 or wepkey3 value to the setWiFiMultipleConfig/delWiFiMultipleConfig endpoints in /cgi-bin/cstecgi.cgi, which can lead to code execution or a crash. The CVSS 4.0 score of 8.6 reflects high confidentiality, integrity and availability impact with no user interaction, but exploitation requires authenticated access (PR:L in both the CVSS 4.0 vector and the assessed CVSS 3.1 vector), so the attacker must already hold valid low-privilege credentials and be able to reach the router's HTTP management interface - typically LAN-side rather than WAN-exposed in default deployments. A public PoC reference exists (a gist linked from the VulDB entry); it is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation.
Stack-based buffer overflow in the TOTOLINK A950RG Basic Wireless Configuration Handler (firmware 4.1.2cu.5268_B20221104) allows remote attackers with low-privilege authentication to corrupt memory by submitting an overlong 'wepkey' value to /cgi-bin/cstecgi.cgi, with high confidentiality, integrity, and availability impact assessed. Exploitation requires network reachability to the router's web management interface and authenticated access sufficient to reach the handler; no user interaction is needed. A public PoC reference exists but is not verified as working exploit code, no CISA KEV listing is indicated, and the issue is assessed as this_week priority rather than an emergency.
A stack-based buffer overflow in the Easy Setup Wizard handler of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 lets remote attackers corrupt memory by sending a manipulated functionType argument to setAppEasyWizardConfig in /cgi-bin/cstecgi.cgi, with high impact on confidentiality, integrity and availability. The supplied CVSS vector carries PR:L, so the attacker must hold valid low-privilege credentials or an authenticated session against the device's web management interface, and the interface must be network-reachable (LAN, or WAN where exposed). A public PoC reference exists but is not verified as working exploit code, and no CISA KEV entry indicates active exploitation; priority is assessed as this_week rather than emergency tier.
Stack-based buffer overflow in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 affects the Device-Information CGI handler infostat.cgi, where manipulation of the CONTENT_LENGTH argument in sub_402340 can corrupt stack memory and potentially lead to code execution or denial of service. The issue is remotely reachable, and the supplied CVSS 4.0 vector (PR:N/UI:N) indicates no authentication or user interaction is required when the router's web interface is reachable, although typical SOHO deployments expose management only on the LAN unless remote/web administration has been enabled. A public PoC reference exists but is not verified as working exploit code; no CISA KEV confirmation is present, EPSS is 0.61% (49th percentile), and the vuln.today decision label is act_now.
Command injection in the device-information handler of the TOTOLINK A950RG router (firmware 4.1.2cu.5268_B20221104) allows an attacker who can influence the MAC-address value processed by getDeviceInfo to execute arbitrary shell commands on the device. The CVSS vector requires high privileges (PR:H) to reach the vulnerable code path, and the available sources do not specify how a malicious MAC value reaches /var/lib/misc/udhcpd.leases - whether via unauthenticated LAN DHCP traffic or authenticated configuration - so the precise unauthenticated reachability is not confirmed. A public PoC reference exists but is not verified as working exploit code; there is no confirmed active exploitation (no CISA KEV listing), and EPSS is 2.74% (86th percentile), which places it in the upper band of predicted exploitation likelihood and is consistent with the 'this_week' prioritisation label.
Command injection in the Cloud Upgrade component of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 allows a remote attacker with a low-privilege authenticated session to pass a crafted FileName value into an OS command through the setCloudUpgradeFW function. The assessed CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and EPSS is 1.55% (75th percentile), indicating high technical severity but not top-percentile exploitation likelihood. A public PoC reference exists; it is not verified as working exploit code, and no CISA KEV entry is present.
Least-privilege violation across multiple TOTOLINK SOHO router models (A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10, EX200 through firmware 20260906) stems from the /etc/boa/boa.conf configuration of the Boa web-server interface, allowing a low-privileged remote actor to gain access or information beyond their intended authorization boundary. The flaw carries CVSS 4.0 base score 7.7 with high attack complexity, and VulDB rates real-world exploitation as difficult. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 allows remote, unauthenticated attackers to read limited device data by manipulating the token argument handled by getLanguageCfg in global.so. The issue is moderate severity (CVSS 4.0 base 5.5; independent CVSS 3.1 assessment AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) and is constrained mainly by network reachability of the router management interface, which is typically LAN-side unless remote management is exposed. A public PoC reference exists; it is not verified as working exploit code, no active exploitation is confirmed in the supplied data, and EPSS is low at 0.40% (34th percentile).
Stack-based buffer overflow in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 lets a remote, low-privileged authenticated user trigger memory corruption by supplying an overlong addEffect argument to the setMacFilterRules function in /cgi-bin/cstecgi.cgi. Successful exploitation can produce high confidentiality, integrity, and availability impact, but the device's web management interface is typically LAN-bound, so Internet exploitation generally requires exposed remote management or an internal foothold. A public PoC reference exists; it is not verified as working exploit code, and no active exploitation is confirmed.
A stack-based buffer overflow in the Multi-SSID Configuration handler of the TOTOLINK A950RG wireless router (firmware 4.1.2cu.5268_B20221104) lets an attacker who is logged in to the web management interface corrupt memory by sending an oversized wepkey2 or wepkey3 value to the setWiFiMultipleConfig/delWiFiMultipleConfig endpoints in /cgi-bin/cstecgi.cgi, which can lead to code execution or a crash. The CVSS 4.0 score of 8.6 reflects high confidentiality, integrity and availability impact with no user interaction, but exploitation requires authenticated access (PR:L in both the CVSS 4.0 vector and the assessed CVSS 3.1 vector), so the attacker must already hold valid low-privilege credentials and be able to reach the router's HTTP management interface - typically LAN-side rather than WAN-exposed in default deployments. A public PoC reference exists (a gist linked from the VulDB entry); it is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation.
Stack-based buffer overflow in the TOTOLINK A950RG Basic Wireless Configuration Handler (firmware 4.1.2cu.5268_B20221104) allows remote attackers with low-privilege authentication to corrupt memory by submitting an overlong 'wepkey' value to /cgi-bin/cstecgi.cgi, with high confidentiality, integrity, and availability impact assessed. Exploitation requires network reachability to the router's web management interface and authenticated access sufficient to reach the handler; no user interaction is needed. A public PoC reference exists but is not verified as working exploit code, no CISA KEV listing is indicated, and the issue is assessed as this_week priority rather than an emergency.
A stack-based buffer overflow in the Easy Setup Wizard handler of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 lets remote attackers corrupt memory by sending a manipulated functionType argument to setAppEasyWizardConfig in /cgi-bin/cstecgi.cgi, with high impact on confidentiality, integrity and availability. The supplied CVSS vector carries PR:L, so the attacker must hold valid low-privilege credentials or an authenticated session against the device's web management interface, and the interface must be network-reachable (LAN, or WAN where exposed). A public PoC reference exists but is not verified as working exploit code, and no CISA KEV entry indicates active exploitation; priority is assessed as this_week rather than emergency tier.
Stack-based buffer overflow in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 affects the Device-Information CGI handler infostat.cgi, where manipulation of the CONTENT_LENGTH argument in sub_402340 can corrupt stack memory and potentially lead to code execution or denial of service. The issue is remotely reachable, and the supplied CVSS 4.0 vector (PR:N/UI:N) indicates no authentication or user interaction is required when the router's web interface is reachable, although typical SOHO deployments expose management only on the LAN unless remote/web administration has been enabled. A public PoC reference exists but is not verified as working exploit code; no CISA KEV confirmation is present, EPSS is 0.61% (49th percentile), and the vuln.today decision label is act_now.
Command injection in the device-information handler of the TOTOLINK A950RG router (firmware 4.1.2cu.5268_B20221104) allows an attacker who can influence the MAC-address value processed by getDeviceInfo to execute arbitrary shell commands on the device. The CVSS vector requires high privileges (PR:H) to reach the vulnerable code path, and the available sources do not specify how a malicious MAC value reaches /var/lib/misc/udhcpd.leases - whether via unauthenticated LAN DHCP traffic or authenticated configuration - so the precise unauthenticated reachability is not confirmed. A public PoC reference exists but is not verified as working exploit code; there is no confirmed active exploitation (no CISA KEV listing), and EPSS is 2.74% (86th percentile), which places it in the upper band of predicted exploitation likelihood and is consistent with the 'this_week' prioritisation label.
Command injection in the Cloud Upgrade component of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 allows a remote attacker with a low-privilege authenticated session to pass a crafted FileName value into an OS command through the setCloudUpgradeFW function. The assessed CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and EPSS is 1.55% (75th percentile), indicating high technical severity but not top-percentile exploitation likelihood. A public PoC reference exists; it is not verified as working exploit code, and no CISA KEV entry is present.
Least-privilege violation across multiple TOTOLINK SOHO router models (A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10, EX200 through firmware 20260906) stems from the /etc/boa/boa.conf configuration of the Boa web-server interface, allowing a low-privileged remote actor to gain access or information beyond their intended authorization boundary. The flaw carries CVSS 4.0 base score 7.7 with high attack complexity, and VulDB rates real-world exploitation as difficult. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 allows remote, unauthenticated attackers to read limited device data by manipulating the token argument handled by getLanguageCfg in global.so. The issue is moderate severity (CVSS 4.0 base 5.5; independent CVSS 3.1 assessment AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) and is constrained mainly by network reachability of the router management interface, which is typically LAN-side unless remote management is exposed. A public PoC reference exists; it is not verified as working exploit code, no active exploitation is confirmed in the supplied data, and EPSS is low at 0.40% (34th percentile).