On this page (7 sections)
A stack-based buffer overflow has been recorded in the TOTOLINK A950RG router, firmware version 4.1.2cu.5268_B20221104. The NVD entry for CVE-2026-121599 says the flaw can be attacked remotely and that the exploit is now public and may be used.
If you run this router at an office, a shop or a client site, or if it sits in front of a web server or management network, you should treat it as exposed until you hear otherwise from the vendor. The research so far is thin, so this article separates what is confirmed from what is not.
What happened
The CVE record was published on 2026-11-04. It describes a flaw in the Multi-SSID Configuration component of the router's management interface. The affected code is the setWiFiMultipleConfig and delWiFiMultipleConfig functions in the file /cgi-bin/cstecgi.cgi. According to the record, manipulating the wepkey2 or wepkey3 argument causes a stack-based buffer overflow.
The record references a public write-up on GitHub Gist and VulDB entries, and it states that the exploit is public. We have not seen a vendor advisory, a patch or a firmware release note. Only one independent publisher covers this so far, so details may change as more information appears.
Technical details in plain terms
A stack-based buffer overflow happens when a program copies more data into a fixed-size memory area than it can hold, and the extra data overwrites neighboring memory. On embedded devices such as routers this can crash the service, and in worse cases let an attacker run their own code. The CVE record does not state the exact impact for this flaw, so we cannot say whether code execution is possible, only that the weakness class is a memory-corruption one (CWE-119 and CWE-121).
The record says the attack can be launched remotely. It does not say whether authentication is required, or whether the management interface must be reachable from the internet. Until that is clarified, assume the worst case: anyone who can reach the router's management interface may be able to try it.
Who is affected
Only the TOTOLINK A950RG on firmware 4.1.2cu.5268_B20221104 is named in the record. Other firmware versions or other TOTOLINK models may be affected too, but the research does not say, so do not assume they are safe or vulnerable.
- Small offices and shops using the A950RG as their main router.
- Agencies and administrators who installed these routers at client locations.
- Anyone whose router's web administration page can be reached from the internet or from untrusted networks.
How to check your exposure
First confirm the model and firmware version. Log in to the router's admin page from inside your network and look at the status or firmware page. Compare the version string with 4.1.2cu.5268_B20221104.
Next, find out whether the admin interface is reachable from outside. From a device that is not on your network (for example a phone on mobile data), try opening the router's public IP address in a browser. If a login page loads, remote administration is exposed.
Webforta's tools focus on websites rather than router firmware, so they cannot tell you whether a router is vulnerable. Your router's own settings page is the reliable source for the model and firmware version.
What to do now
No vendor fix is documented in the research, so the priority is to cut the attack surface. Check the TOTOLINK website for firmware updates for the A950RG and install one if it addresses this CVE.
0 of 8 done
If you have a Linux gateway or reverse proxy that logs requests to the router, you can look for the vulnerable path in logs you control. This read-only search prints access log lines that mention that path. The log location below is only an example, so adjust it to your system.
grep "cstecgi.cgi" /var/log/nginx/access.logMost consumer routers do not keep detailed logs, so an empty result does not prove the device was never targeted.
Detection and monitoring afterwards
Watch for signs that a router has been tampered with: unexpected reboots, changed Wi-Fi or DNS settings, new admin accounts, or devices behind it suddenly reaching unfamiliar hosts. If you see any of these, follow the steps in Website hacked: what to do and consider a factory reset followed by reconfiguration with a fresh password.
For the websites behind your network, Webforta Monitor can alert you to uptime, certificate and DNS changes, which can help you notice if traffic or records are altered. It does not inspect router firmware and cannot tell you whether this CVE affects a device.
What is still unknown
- Whether TOTOLINK has released or plans a fixed firmware version.
- Whether authentication is needed to reach the vulnerable function.
- Whether the flaw allows code execution or only a crash.
- Whether attacks are happening against real devices.
We will treat the situation as unresolved until a vendor advisory or patch appears. The CVSS score of 8.6 is the figure shown in the CVE record we reviewed.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.