CVE-2026-121600: Critical Stack Overflow in TOTOLINK A950RG

CVE-2026-121600 is a stack-based buffer overflow in the TOTOLINK A950RG router version 4.1.2cu.5268_B20221104. The vulnerability resides in the MAC Filter Handler component, in the setMacFilterRules function of the /cgi-bin/cstecgi.cgi file. The addEffect parameter is not properly validated, allowing a remote attacker to send malformed input that causes stack overflow. The router is a critical device for enterprise and administrative networks: compromise would enable unauthorized access and remote control of filter configuration and traffic routing.

The CVSS score is 9.9 (critical). According to official description, the exploit has already been published and may be actively used. Signals have been recorded on social networks in the past 24 hours confirming security community attention to the severity of the flaw. No signals of exploit distribution through public code repositories have been reported, but publication of the exploit increases the risk of rapid exploitation.

Administrators must immediately verify whether TOTOLINK A950RG routers running version 4.1.2cu.5268_B20221104 are present in their infrastructure. Contact TOTOLINK support for available security patches. Restrict access to the MAC Filter Handler via firewall, segment administrative networks, and monitor /cgi-bin/cstecgi.cgi logs to detect exploitation attempts. If patches are not available, consider temporary device isolation or WAF gateway to filter malformed requests to the vulnerable component.

The nature of the flaw (stack overflow) allows code to overwrite a function's return address, enabling arbitrary code execution with the privileges of the CGI service. Since the router is remotely reachable without apparent authentication requirements in the setMacFilterRules function, exploitation difficulty is low and danger is maximum for unpatched systems.

Monitor TOTOLINK official channels, security mailing lists, and the NVD site for patch availability updates. Security operations teams should add CVE-2026-121600 to vulnerability scanning systems to identify affected devices during discovery. Once patches become available, plan updates during maintenance windows, prioritizing routers exposed on administrative networks.