CVE-2026-121599

Description

A vulnerability was detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function setWiFiMultipleConfig/delWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi of the component Multi-SSID Configuration. The manipulation of the argument wepkey2/wepkey3 results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.

Affected products

References

External links from the record. They lead to third-party sites.

• VDB-430441 | TOTOLINK A950RG Multi-SSID Configuration cstecgi.cgi delWiFiMultipleConfig stack-based overflow technical-description, vdb-entry
  https://vuldb.com/vuln/430441
• VDB-430441 | CTI Indicators (IOB, IOC, IOA) permissions-required, signature
  https://vuldb.com/vuln/430441/cti
• CVE-2026-121599 | CVE Analysis and Report third-party-advisory
  https://vuldb.com/cve/CVE-2026-121599
• Submit #1022561 | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Stack Buffer Overflow third-party-advisory
  https://vuldb.com/submit/1022561
• https://gist.github.com/H3rmesk1t/44673654282c9b21bc8971bab7e4b8a3 exploit
• https://www.totolink.net/ product