CVE-2026-121600 is a remotely triggerable stack-based buffer overflow in TOTOLINK A950RG router firmware, rated CVSS 3.1 9.9 (Critical), and a public exploit is available.
What Is It
The flaw is in the setMacFilterRules function of /cgi-bin/cstecgi.cgi, which is part of the device's MAC Filter Handler component. Manipulating the addEffect argument causes a stack-based buffer overflow. The weaknesses are classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
VulDB, acting as the CNA, published the CVE. NVD lists its status as "Deferred."
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That means the attack works over the network, has low complexity, needs only low privileges and no user interaction, and has a changed scope with high impact to confidentiality, integrity and availability. The CVSS 4.0 score is 8.6 (High), and its exploit maturity is marked as Proof-of-Concept.
The NVD description says the exploit "has been published and may be used," and one of the references is a public write-up on GitHub Gist. This CVE has no entry in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation in the wild. Even so, the published exploit makes exposed devices easier to attack.
What's Vulnerable
- Vendor: TOTOLINK
- Product: A950RG
- Affected firmware: 4.1.2cu.5268_B20221104
- Component: MAC Filter Handler (
/cgi-bin/cstecgi.cgi,setMacFilterRules) - CPE:
cpe:2.3:o:totolink:a950rg_firmware:*:*:*:*:*:*:*:*
Patch Status
The source material does not mention a vendor patch or fixed firmware version. Since there is no KEV entry, CISA has not issued a required action or due date. Anyone running the affected firmware should check the TOTOLINK website for updates. Until a fix is confirmed, avoid exposing the device's web management interface to untrusted networks.