On this page (7 sections)
A stack-based buffer overflow has been reported in the TOTOLINK A950RG router, firmware version 4.1.2cu.5268_B20221104. According to the NVD record, the flaw can be triggered remotely and the exploit has been disclosed publicly and may be used.
If you manage this router at an office, a branch site or for a client, treat it as a device that needs attention now. Only one independent publisher covers this story so far, and the sources do not mention a vendor fix, so the practical focus is on limiting exposure.
What was reported
The NVD entry, published on 2026-11-04, describes a flaw in the function strcpy in the file /cgi-bin/cstecgi.cgi, part of the Basic Wireless Configuration Handler. Manipulating the argument wepkey leads to a stack-based buffer overflow. The record says the attack can be started remotely.
The record also says the exploit has been disclosed publicly. The references include a public GitHub gist and an entry on VulDB. We have not relied on those pages for technical detail beyond what NVD states, and this article does not include exploit details.
The weakness in plain terms
A stack-based buffer overflow happens when a program copies input into a fixed-size memory area without checking its length. The C function strcpy is a classic cause, because it copies until it reaches the end of the input, however long that is. Here the input is a wireless key value (wepkey) sent to the router's CGI program.
In embedded devices like routers, overflows of this kind commonly lead to crashes, and in some cases to attackers running their own code. The NVD description does not say which outcome applies here, so do not assume either. What it does confirm is the weakness type, the remote attack vector and a CVSS score of 8.6.
Who is realistically exposed
- Owners of a TOTOLINK A950RG running firmware 4.1.2cu.5268_B20221104. Other versions are not covered by the record, so their status is unknown rather than safe.
- Networks where the router's web administration page is reachable from the internet or from untrusted internal segments such as guest Wi-Fi.
- Small offices and remote sites that rely on consumer-grade routers and rarely check firmware.
The research does not say whether authentication is required to reach the vulnerable handler, so assume the worst case: anyone who can reach the management interface may be able to attempt it.
How to check your exposure
Start by identifying the model and firmware. In the router's admin page, look for the firmware version on the status or system page and compare it with 4.1.2cu.5268_B20221104. The label on the device confirms the model.
Next, check whether the admin interface is reachable from outside. From a machine on a different network (not your LAN), run this read-only command, replacing the placeholder with your router's public IP address. If it returns HTTP response headers, the web interface is exposed to the internet; a timeout or connection error suggests it is not reachable on that port:
curl -I --max-time 10 http://YOUR_PUBLIC_IP/You can also review the router's remote management, port forwarding and UPnP settings in the admin page and note anything that exposes the web interface.
What to do now
No patched firmware version is named in the research. Check the TOTOLINK website for a firmware update for the A950RG and apply it if one addresses this CVE. Until then, reduce exposure:
0 of 8 done
Detection and monitoring
Because exploitation in the wild is unconfirmed, there are no published indicators to hunt for. Reasonable signals to watch are unexpected router reboots or crashes, unexplained configuration changes, and unfamiliar connections to the admin interface from outside your network.
If the router sits in front of a website or office network, keep an eye on the services behind it. Webforta Monitor can track uptime, certificate and DNS changes, which helps you notice if something unusual happens after a network device is tampered with. It does not patch or detect this router flaw itself. For general guidance, see our guide on how to check if a website is hacked.
What we do not know yet
- Whether TOTOLINK has released fixed firmware or acknowledged the issue.
- Whether the flaw requires authentication.
- Whether other firmware versions or other TOTOLINK models are affected.
- Whether attackers are exploiting it. The NVD record says only that the exploit is public and may be used, and CISA KEV does not list it.
We will treat this as an evolving story. Because the NVD record is the only primary source in our research, re-check it and the vendor site for updates.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.