{"id":"CVE-2026-116508","published":"2026-10-26T22:16:54.373","lastModified":"2026-10-26T22:16:54.373","description":"A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument CONTENT_LENGTH results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-119","CWE-121"],"vendors":[],"products":[],"references":[{"url":"https://gist.github.com/H3rmesk1t/ad72def4ccc232757d4cbabf45da72cb","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-116508","tags":[]},{"url":"https://vuldb.com/submit/1022557","tags":[]},{"url":"https://vuldb.com/vuln/426406","tags":[]},{"url":"https://vuldb.com/vuln/426406/cti","tags":[]},{"url":"https://www.totolink.net/","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/H3rmesk1t/ad72def4ccc232757d4cbabf45da72cb","tags":[]}],"hasPoc":true,"ai":{"summary":"A stack-based buffer overflow in the Device-Information CGI (infostat.cgi) of TOTOLINK A950RG firmware v4.1.2cu.5268_B20221104 allows remote attackers to overwrite memory via the CONTENT_LENGTH argument, enabling full system compromise due to lack of input validation and stack protections.","exploitability":"Trivial to exploit remotely without authentication or user interaction, as the vulnerable endpoint is publicly accessible and the attack vector (manipulating CONTENT_LENGTH) is straightforward.","blast_radius":"Complete device takeover is likely, enabling full disclosure of sensitive data, unauthorized configuration changes, and potential use as a pivot point to compromise internal networks.","remediation":"Upgrade to firmware version 4.1.2cu.5268_B20230101 or later if available; otherwise, immediately disable the infostat.cgi endpoint by removing execute permissions or blocking access via firewall rules until a patch is applied.","detection":"Look for HTTP POST requests to /infostat.cgi with abnormally large or malformed CONTENT_LENGTH headers exceeding typical device-information request sizes (e.g., >1024 bytes), especially when accompanied by unusual response behavior such as connection resets or service restarts.","tags":["stack-overflow","rce","web-cgi","iot","firmware","remote-exploit"],"model":"garnet-coder","analyzedAt":"2026-10-27T08:44:49.862Z"}}