Threat level Severe
Contact
Critical 9.9
CVE-2026-121597

TOTOLINK A950RG — buffer overflow.

A weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104.

WeaknessCWE-119: Memory corruptionCWE-121: Stack buffer overflow
Published Source NVD
Read vendor advisoryView on NVD
CVSS 3.1
9.9
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Exploit chance, 30 days
Not scored yet
EPSS scores new CVEs within a day or two
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory

What happened

A weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setAppEasyWizardConfig of the file /cgi-bin/cstecgi.cgi of the component Easy Setup Wizard Handler. Executing a manipulation of the argument functionType can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

What to do

  1. 01Check whether you run TOTOLINK A950RG, and which version.
  2. 02Follow the vendor advisory for a fix or a workaround.

References

Timeline · UTC

  1. Published to NVD

Also actively exploited

CVE-2026-1185274.3Ivanti Connect SecureCVE-2026-1199778.1WordPress WordPress CoreCVE-2026-764188.6Cisco Secure Firewall ASA Software and Cisco Secure FTD Software
Vendor
TOTOLINK44 CVEs in 30 days
All TOTOLINK CVEs

Other CVEs in TOTOLINK A950RG

8 more CVEs

All TOTOLINK A950RG CVEs
9.9TOTOLINK A950RG — buffer overflow.9.9TOTOLINK A950RG — buffer overflow.9.9TOTOLINK A950RG — buffer overflow.10.0TOTOLINK A950RG — buffer overflow.EPSS 0.6%9.9TOTOLINK A950RG — command injection.EPSS 1.9%9.9TOTOLINK A950RG — command injection.EPSS 1.5%