CVE-2026-121597: Critical Buffer Overflow in TOTOLINK A950RG

CVE-2026-121597 describes a stack-based buffer overflow vulnerability in the Easy Setup Wizard Handler component of TOTOLINK A950RG router version 4.1.2cu.5268_B20221104. The flaw is located in /cgi-bin/cstecgi.cgi and can be exploited remotely by manipulating the functionType parameter without requiring authentication. It affects all administrators managing this router family, particularly in SMB and SOHO environments where TOTOLINK A950RG is commonly deployed.

With a CVSS score of 9.9, the flaw has critical severity and enables remote attacks with maximum impact on the device's availability, integrity, and confidentiality. The current status is particularly critical: the exploit has been made public and is accessible according to NVD data, and no official patch is currently available. Signals on X in recent days show 2 posts with a total of 23 engagements, indicating growing visibility in the threat landscape.

Pending an official patch, administrators must implement immediate mitigations: network isolation from affected routers through segmentation, disabling the Easy Setup Wizard service if configuration allows, active monitoring of traffic to /cgi-bin/cstecgi.cgi, and rapid verification of IT inventory to identify which TOTOLINK A950RG 4.1.2cu.5268_B20221104 devices are in use within your infrastructure. Scanning internal networks to identify this specific version is an absolute priority.