critical · CVSS v3 9.9 · CVSS v4 9.4

CVE-2026-121600

The vulnerability is a stack-based buffer overflow in the MAC Filter Handler of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104. It can be t

Overview

The vulnerability is a stack-based buffer overflow in the MAC Filter Handler of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104. It can be triggered remotely via the addEffect parameter in cstecgi.cgi, allowing attackers to crash the device or potentially execute arbitrary code.

Description

A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component MAC Filter Handler. This manipulation of the argument addEffect causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.

Impact

Confidentiality: remote attacker could gain code execution, leading to full device compromise. Integrity: attacker can modify MAC filter rules or disrupt network. Availability: device may crash, causing denial of service. Defenders: network administrators and firmware maintainers.

Remediation

Apply the official firmware update 4.1.2cu.5269 or later that fixes the buffer overflow. If an update is not available, disable the MAC Filter feature or block access to /cgi-bin/cstecgi.cgi via firewall or ACL. Monitor logs for anomalous requests to addEffect.

Risk context

Critical severity (CVSS 9.9) indicates high risk; immediate action is recommended.

Affected products

  • TOTOLINK A950RG

Scores

Severity
critical
CVSS v2
9
CVSS v3
9.9
CVSS v4
9.4
EPSS
—

buffer-overflow remote-exploit router critical mac-filter firmware network-security

← All CVEs

Related CVEs

critical

CVE-2026-114549

NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 4443 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30685.

View analysis

critical

CVE-2026-120635

CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. The multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the boundary without its leading -- for some client-supplied User-Agent values, finds the Content-Disposition name and filename inside the quoted values of other parameters, and corrupts parts when the boundary nears the 4096-byte read size.

View analysis

critical

CVE-2026-120637

CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD. For a REQUEST_METHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and path_info from the process's command line arguments.

View analysis

critical

CVE-2026-120641

CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths. The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header, unchanged. An application that saves the upload under this name can be made to write outside the intended directory.

View analysis