CVE-2026-116508 is a critical, remotely exploitable stack-based buffer overflow in the Device-Information CGI of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104, and a public exploit has been released.
What Is It
The flaw is in the function sub_402340 of infostat.cgi, part of the router's Device-Information CGI component. Manipulating the CONTENT_LENGTH argument causes a stack-based buffer overflow. The weaknesses are classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
VulDB, the CNA, published the CVE on 2026-10-26. Its NVD status is "Received," so NVD has not yet completed its analysis.
Why It Matters
- CVSS 3.1: 10.0 (Critical). Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The attack works over the network, has low complexity, and needs no privileges or user interaction. Scope is changed, and impact on confidentiality, integrity and availability is high. - CVSS 4.0: 9.3 (Critical). Exploit maturity is rated Proof-of-Concept.
- CVSS 2.0: 10.0.
- Public exploit. According to the CNA description, the exploit "has been released to the public and may be used for attacks." A third-party write-up is linked in the references.
- Not in CISA KEV. No CISA KEV entry was supplied for this CVE, so KEV does not currently confirm active exploitation. That could change, since a public exploit exists.
What's Vulnerable
- Vendor: TOTOLINK
- Product: A950RG
- Component: Device-Information CGI (
infostat.cgi) - Affected version: 4.1.2cu.5268_B20221104
- CPE:
cpe:2.3:o:totolink:a950rg_firmware:*:*:*:*:*:*:*:*
Patch Status
The supplied records do not mention a vendor patch, a fixed firmware version or vendor guidance. There is no CISA KEV entry, so no federal required action or due date applies. Owners of A950RG devices on the affected firmware should check TOTOLINK's site for updates. Until a fix is confirmed, they should keep the device's web management interface off untrusted networks.