CVE-2026-121598 is a critical (CVSS 3.1: 9.9) stack-based buffer overflow in TOTOLINK A950RG router firmware. An authenticated attacker can trigger it remotely, and a public exploit has been disclosed.
What Is It
The flaw is in the Basic Wireless Configuration Handler of TOTOLINK A950RG firmware version 4.1.2cu.5268_B20221104. The wepkey argument sent to /cgi-bin/cstecgi.cgi is passed to an unsafe strcpy call, which causes a stack-based buffer overflow. It is classified as CWE-121 (Stack-based Buffer Overflow) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).
VulDB is the CNA that reported and published the CVE. NVD lists the record's status as "Deferred."
Why It Matters
VulDB gives the issue a score under three CVSS versions:
- CVSS 3.1: 9.9 Critical (
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 8.6 High, with exploit maturity rated Proof-of-Concept
- CVSS 2.0: 9.0 High
The attack works over the network with low complexity and no user interaction. It needs only low privileges, which means the attacker must first log in to the device. The CVSS 3.1 vector marks the scope as changed, with high impact to confidentiality, integrity and availability.
The NVD description says the exploit "has been disclosed publicly and may be used," and the references link to a public write-up.
This CVE is not in the CISA Known Exploited Vulnerabilities (KEV) catalog. The data reviewed here shows no evidence of active exploitation in the wild. However, a missing KEV entry doesn't rule out exploitation, and a public exploit is available.
What's Vulnerable
- Vendor: TOTOLINK
- Product: A950RG
- Component: Basic Wireless Configuration Handler (
/cgi-bin/cstecgi.cgi) - Affected version: 4.1.2cu.5268_B20221104
- CPE:
cpe:2.3:o:totolink:a950rg_firmware:*:*:*:*:*:*:*:*
The record lists only this one firmware version as affected. It doesn't say whether other versions are affected.
Patch Status
The NVD and VulDB data reviewed here doesn't mention a vendor patch, a fixed firmware version or a vendor advisory. There is no KEV entry, so no CISA remediation deadline or required action applies.
Owners of the A950RG should check the TOTOLINK website for firmware updates. Exploitation needs network access to the device and valid credentials. Until a fix is confirmed, limit who can reach the web management interface and who holds login credentials for it.