CVE-2026-121597 is a critical stack-based buffer overflow that can be triggered remotely in the TOTOLINK A950RG router's Easy Setup Wizard handler, and a public exploit is already available.
What Is It
The flaw is in the setAppEasyWizardConfig function of /cgi-bin/cstecgi.cgi, which belongs to the Easy Setup Wizard Handler component of TOTOLINK A950RG firmware. Changing the functionType argument can cause a stack-based buffer overflow. The weaknesses are classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
VulDB, the CVE Numbering Authority (CNA), assigned the following scores:
- CVSS 3.1: 9.9 CRITICAL (
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 8.6 HIGH, with exploit maturity rated Proof-of-Concept
- CVSS 2.0: 9.0
Why It Matters
The attack can be launched over the network. It has low attack complexity, needs only low privileges, and requires no user interaction. The CVSS 3.1 vector rates the scope as changed, with high impact to confidentiality, integrity and availability. In practice, a successful attack could affect more than the vulnerable component itself.
The NVD description says the exploit has been made public and could be used for attacks. A proof-of-concept write-up is listed among the references.
This CVE has no CISA KEV entry. KEV does not confirm active exploitation at this time. NVD lists the record's status as "Deferred."
What's Vulnerable
- Vendor: TOTOLINK
- Product: A950RG
- Affected version: 4.1.2cu.5268_B20221104
- Component: Easy Setup Wizard Handler (
/cgi-bin/cstecgi.cgi,setAppEasyWizardConfig) - CPE:
cpe:2.3:o:totolink:a950rg_firmware:*:*:*:*:*:*:*:*
The supplied records list no other firmware versions as affected or unaffected.
Patch Status
The supplied NVD and VulDB data do not list a fixed firmware version, a vendor advisory, or a remediation step. The only vendor reference is the TOTOLINK homepage. CISA has not issued a required action because the CVE is not in the KEV catalog. Owners of A950RG devices running 4.1.2cu.5268_B20221104 should check TOTOLINK directly for firmware updates.