CVE-2026-121598

Description

A security vulnerability has been detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function strcpy of the file /cgi-bin/cstecgi.cgi of the component Basic Wireless Configuration Handler. The manipulation of the argument wepkey leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

Affected products

References

External links from the record. They lead to third-party sites.

• VDB-430440 | TOTOLINK A950RG Basic Wireless Configuration cstecgi.cgi strcpy stack-based overflow technical-description, vdb-entry
  https://vuldb.com/vuln/430440
• VDB-430440 | CTI Indicators (IOB, IOC, IOA) permissions-required, signature
  https://vuldb.com/vuln/430440/cti
• CVE-2026-121598 | CVE Analysis and Report third-party-advisory
  https://vuldb.com/cve/CVE-2026-121598
• Submit #1022559 | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Stack Buffer Overflow third-party-advisory
  https://vuldb.com/submit/1022559
• https://gist.github.com/H3rmesk1t/e283a4f3224cbd0a57d4392de60bd2c6 exploit
• https://www.totolink.net/ product