A remotely exploitable stack-based buffer overflow in TOTOLINK A950RG router firmware rated CVSS 9.9 Critical, with a public exploit.
What Is It
CVE-2026-121599 is a stack-based buffer overflow (CWE-121, CWE-119) in the TOTOLINK A950RG router. It sits in the setWiFiMultipleConfig and delWiFiMultipleConfig functions of /cgi-bin/cstecgi.cgi, which belong to the device's Multi-SSID Configuration component. An attacker triggers the overflow by manipulating the wepkey2 or wepkey3 arguments, and can do so remotely.
VulDB published the CVE as the CVE Numbering Authority (CNA). NVD lists its status as "Deferred," so NVD has not done its own analysis.
Why It Matters
The CNA scores it 9.9 Critical under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). It is reachable over the network, attack complexity is low and no user interaction is needed. A successful attack has high impact on confidentiality, integrity and availability, and the scope is "changed," meaning the impact can extend beyond the vulnerable component. CVSS 4.0 rates it 8.6 High and CVSS 2.0 rates it 9.0.
Three factors shape the real-world risk:
- Authentication (limits risk): low privileges are required (CVSS 3.1
PR:L; CVSS 2.0 "Authentication: Single"). An attacker needs some level of authenticated access first. - Exploit availability (raises risk): the record says the exploit "is now public and may be used," and CVSS 4.0 marks exploit maturity as Proof-of-Concept.
- KEV status: CVE-2026-121599 is not in the supplied CISA Known Exploited Vulnerabilities (KEV) data. KEV does not confirm active exploitation in the wild at this time.
What's Vulnerable
- Vendor: TOTOLINK
- Product: A950RG
- Affected version: firmware
4.1.2cu.5268_B20221104 - Component: Multi-SSID Configuration (
/cgi-bin/cstecgi.cgi) - CPE:
cpe:2.3:o:totolink:a950rg_firmware:*:*:*:*:*:*:*:*
The record names only this one firmware build as affected. The CPE string uses a version wildcard, though, so it does not rule out other builds.
Patch Status
The supplied NVD record names no fixed firmware version or vendor advisory, and there is no CISA KEV entry, so no federal required action or due date applies. Owners of A950RG devices on the affected firmware should check TOTOLINK's site for updated firmware. Until a fix is confirmed, limit who can log in to and reach the device's management interface.