CVE-2026-121597: TOTOLINK A950RG Easy Setup Wizard cstecgi.cgi setAppEasyWizardConfig stack-based overflow
A weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268B20221104. This affects the function setAppEasyWizardConfig of the file /cgi-bin/cstecgi.cgi of the component Easy Setup Wizard Handler. Executing a manipulation of the argument functionType can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue can be exploited remotely with low attack complexity, but the supplied CVSS vector indicates that the attacker needs low-level privileges. No user interaction is required.
Which systems are known to be affected?
The affected product and version identified in the available data are TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104. The vulnerable functionality is the Easy Setup Wizard Handler in /cgi-bin/cstecgi.cgi.
Is exploit code available?
Yes. The vulnerability is flagged as having a proof of concept, and the description states that a public exploit is available.