critical · CVSS v3 9.9 · CVSS v4 9.4

CVE-2026-121597

A stack-based buffer overflow exists in the Easy Setup Wizard Handler of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104. The vulnerability

Overview

A stack-based buffer overflow exists in the Easy Setup Wizard Handler of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104. The vulnerability is triggered by manipulating the functionType argument in /cgi-bin/cstecgi.cgi. It allows remote attackers to potentially execute arbitrary code.

Description

A weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setAppEasyWizardConfig of the file /cgi-bin/cstecgi.cgi of the component Easy Setup Wizard Handler. Executing a manipulation of the argument functionType can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

Impact

Confidentiality: remote attacker could read or modify device configuration. Integrity: attacker could alter network settings or install malicious firmware. Availability: potential crash or reboot. Defenders: network administrators and device owners must patch or isolate the device.

Remediation

Apply the official firmware update that removes the vulnerable function or patches the buffer overflow. If update not available, block external access to /cgi-bin/cstecgi.cgi via firewall or disable Easy Setup Wizard feature. Monitor device logs for abnormal requests to functionType parameter.

Risk context

Critical severity with CVSS 9.9 indicates high likelihood of exploitation. Immediate action recommended.

Affected products

  • TOTOLINK A950RG

Scores

Severity
critical
CVSS v2
9
CVSS v3
9.9
CVSS v4
9.4
EPSS
—

buffer-overflow remote-exploit critical router firmware network-security CVE-2026-121597

← All CVEs

Related CVEs

critical

CVE-2026-121600

The vulnerability is a stack-based buffer overflow in the MAC Filter Handler of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104. It can be triggered remotely via the addEffect parameter in cstecgi.cgi, allowing attackers to crash the device or potentially execute arbitrary code.

View analysis

critical

CVE-2026-114549

NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 4443 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30685.

View analysis

critical

CVE-2026-120635

CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. The multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the boundary without its leading -- for some client-supplied User-Agent values, finds the Content-Disposition name and filename inside the quoted values of other parameters, and corrupts parts when the boundary nears the 4096-byte read size.

View analysis

critical

CVE-2026-120637

CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD. For a REQUEST_METHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and path_info from the process's command line arguments.

View analysis