home / blog
2026-11-04 · critical
CVE-2026-121598: critical buffer overflow in TOTOLINK A950RG
CVSS 9.9: remote stack overflow in TOTOLINK A950RG. Public exploit. Critical impact on wireless network.
CVE-2026-121598 is a stack buffer overflow vulnerability in the TOTOLINK A950RG wireless router version 4.1.2cu.5268_B20221104. The flaw is located in the Basic Wireless Configuration Handler component (/cgi-bin/cstecgi.cgi) and is exploited by manipulating the wepkey parameter of the strcpy function, allowing unauthenticated remote attack.
The vulnerability has a CVSS score of 9.9 (critical), the highest severity level. The exploit was publicly disclosed on 2026-11-04. Social signals identify it as one of the most severe issues this week; however, no official documentation reports a patch from the vendor yet.
Administrators must immediately verify if TOTOLINK A950RG devices are present in the network. Recommendations: temporarily isolate routers from the internet if not strictly necessary, check access logs to the wireless configuration component, contact TOTOLINK support to verify patch availability, and implement access controls to restrict who can reach the management interface.
At a glance
- What
- Stack-based buffer overflow in strcpy function of /cgi-bin/cstecgi.cgi (Basic Wireless Configuration Handler) in TOTOLINK A950RG router version 4.1.2cu.5268_B20221104. Vulnerable parameter: wepkey.
- Severity
- CVSS 9.9 (critical). Stack overflow with potential for unauthenticated remote code execution.
- Affected versions
- TOTOLINK A950RG 4.1.2cu.5268_B20221104. Status of other models and versions not reported.
- Fix
- Patch not reported. Check TOTOLINK official website for available updates.
- Status
- Exploit publicly disclosed (2026-11-04). Active exploitation assessment ongoing.
- Action
- Isolate vulnerable routers; restrict access to configuration interface; update when available; implement ACL for remote management.
Sources: NVD, CVE-2026-121598