CVE-2026-121599 PUBLISHED

A vulnerability was detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function setWiFiMultipleConfig/delWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi of the component Multi-SSID Configuration. The manipulation of the argument wepkey2/wepkey3 results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.

• LiuYijun_JX.SGCC (VulDB User) reporter

• VDB-430441 | TOTOLINK A950RG Multi-SSID Configuration cstecgi.cgi delWiFiMultipleConfig stack-based overflow
• VDB-430441 | CTI Indicators (IOB, IOC, IOA)
• CVE-2026-121599 | CVE Analysis and Report
• Submit #1022561 | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Stack Buffer Overflow
• https://gist.github.com/H3rmesk1t/44673654282c9b21bc8971bab7e4b8a3
• https://www.totolink.net/

• Stack-based Buffer Overflow CWE
• Memory Corruption CWE