CVE-2026-116507: TOTOLINK A950RG global.so getLanguageCfg information disclosure
A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268B20221104. Affected by this vulnerability is the function getLanguageCfg of the file global.so. Such manipulation of the argument token leads to information disclosure. The attack may be launched remotely. The exploit is publicly available and might be used.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be launched remotely and requires no privileges or user interaction. Exploitation involves manipulating the token argument handled by the getLanguageCfg function in global.so.
Which device and firmware version are identified as affected?
The affected product identified in the available data is the TOTOLINK A950RG running firmware version 4.1.2cu.5268_B20221104.
How likely is exploitation in practice?
A public exploit is available and may be used. The reported exploitability conditions are network-accessible with low attack complexity.