CVE-2026-121599: Critical Buffer Overflow in TOTOLINK A950RG

Vulnerability CVE-2026-121599 is a stack-based buffer overflow in the TOTOLINK A950RG router version 4.1.2cu.5268_B20221104. The flaw exists in the setWiFiMultipleConfig and delWiFiMultipleConfig functions of the Multi-SSID Configuration component, accessible through the /cgi-bin/cstecgi.cgi file. Unvalidated input in the wepkey2 and wepkey3 parameters allows a remote attacker to trigger stack buffer overflow, potentially with unauthenticated access.

The vulnerability is classified as critical with a CVSS score of 9.9. The current status is particularly critical: the exploit is already publicly available as of 2026-11-04, the date of official disclosure. In social signals (unverified technical information but indicative of community attention), initial discussion is already evident, confirming the problem's notoriety despite TOTOLINK not being a mainstream enterprise player in the upper market segment.

For sysadmin and CISO defenders: (1) Immediately verify whether TOTOLINK A950RG router version 4.1.2cu.5268_B20221104 is present in your infrastructure and contact the manufacturer for security patches. (2) If no fix is available, isolate affected devices from production networks or implement tight ACLs to block access to the vulnerable CGI functions. (3) Configure monitoring and IDS to detect anomalous traffic to /cgi-bin/cstecgi.cgi. (4) Audit firmware inventory to identify whether earlier versions contain the same vulnerability.