On this page (7 sections)

A stack-based buffer overflow has been published for the TOTOLINK A950RG router, tracked as CVE-2026-121597. The affected firmware is 4.1.2cu.5268_B20221104, and the record says the attack can be carried out remotely and that an exploit has been made public.

If you run this router at an office, a small business site, a branch location or a home lab that hosts services, this is worth acting on today, even though no patch is listed yet. Details below come from the GitHub Advisory Database entry, which the NVD record repeats. That is effectively a single source.

What was disclosed

The record says the flaw affects the function setAppEasyWizardConfig in /cgi-bin/cstecgi.cgi, part of the Easy Setup Wizard Handler component. Manipulating the argument functionType can trigger a stack-based buffer overflow. The advisory states the attack may be performed remotely and that the exploit has been made available to the public and could be used for attacks.

The published CVSS v4 metrics describe a network attack vector, low attack complexity, no attack requirements, low privileges required and no user interaction. Impact to confidentiality, integrity and availability is rated high, for both the vulnerable and subsequent systems. The entry is marked unreviewed in the GitHub database.

What a stack buffer overflow means for a router

A stack-based buffer overflow happens when a program copies more data into a fixed-size memory area than it was built to hold, overwriting neighboring memory. On embedded devices like routers, this class of bug commonly leads to crashes and, in worse cases, to an attacker running their own code on the device. The advisory does not describe the exact outcome for this flaw, so treat the rating (high impact on confidentiality, integrity and availability) as the guide rather than assuming a specific result.

A compromised router sits in front of everything else on your network. It can expose or redirect traffic, change DNS settings, and act as a foothold for reaching internal systems or servers.

Who is realistically exposed

  • Owners of a TOTOLINK A950RG on firmware 4.1.2cu.5268_B20221104, the only version named in the record.
  • Devices whose web management interface is reachable from the internet, since the attack is described as remote.
  • Networks where the router's admin page is reachable from untrusted internal segments, such as guest Wi-Fi.
  • Sites hosted behind or on the same network as such a router, where a compromised gateway would put traffic and credentials at risk.

The CVSS metrics list low privileges as required, so some form of access to the interface may be needed. The sources do not explain what that means in practice, so do not assume a device is safe because you use a strong admin password.

How to check your exposure

  1. Confirm the model and firmware version in the router's admin interface (usually on a status or system page). Compare it with 4.1.2cu.5268_B20221104.
  2. Check whether remote management is enabled in the router settings. If it is, the admin interface may be reachable from the internet.
  3. From a device outside your network (for example a phone on mobile data), try to open the router's public IP address in a browser. If the login page loads, the interface is exposed.
  4. Review the router's DHCP client list and DNS settings for anything you do not recognize.
Webforta can only look at your network from the outside. The free SSL certificate checker and security headers checker are for websites, not routers, so use the steps above for the device itself.

What to do now

The research lists no patched firmware and no vendor advisory, so the priority is reducing exposure while you wait. Watch the TOTOLINK website for firmware updates, and install one only after confirming it is for the A950RG and that it addresses this CVE.

Caution. Changing router settings or flashing firmware can drop connectivity for everything behind it. Do it during a maintenance window and keep a saved copy of the configuration.

Detection and monitoring

There are no published indicators of compromise for this flaw. Practical signals are indirect: unexpected router reboots, changed DNS servers, new port-forwarding rules, unfamiliar admin sessions, or unusual outbound traffic from the router's address. If your router or firewall can log admin-interface requests, look for repeated requests to /cgi-bin/cstecgi.cgi from addresses you do not recognize.

For the websites and services behind the router, Webforta Monitor can alert you to uptime, certificate and DNS changes, which can help you notice if traffic is being redirected. If you suspect compromise, follow our guide on what to do when a website is hacked.

What is still unknown

  • Whether other A950RG firmware versions or other TOTOLINK models are affected. Only one version is named.
  • Whether a fixed firmware exists. The advisory lists patched versions as unknown.
  • Whether attackers are exploiting this in the wild. A public exploit is reported, but no exploitation is confirmed, and the CVE is not in CISA KEV.
  • Whether TOTOLINK has acknowledged the report. The research contains no vendor statement.
  • Whether this issue is related to any other vulnerabilities. The sources do not mention any related CVEs.

Sources

This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.

  1. CVE-2026-121597 - GitHub Advisory Databasegithub.com
  2. CVE-2026-121597: A weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104.nvd.nist.gov ·
  • TOTOLINK
  • router security
  • buffer overflow
  • CVE-2026-121597
  • IoT