CVE-2026-116508: TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow
A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268B20221104. Affected by this issue is the function sub402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument CONTENTLENGTH results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Affected Software
Event History
Frequently Asked Questions
Which deployment should be prioritized for investigation?
TOTOLINK A950RG devices running firmware version 4.1.2cu.5268_B20221104 are identified as affected. The vulnerable component is the Device-Information CGI endpoint, infostat.cgi.
What does an attacker need to exploit the issue?
Remote exploitation is possible through manipulation of the CONTENT_LENGTH argument. The supplied vector indicates network access is sufficient, with no privileges or user interaction required.
Is exploitation likely to be practical?
A public exploit has been released and may be used in attacks. This increases the urgency of identifying exposed affected devices.