{"id":"CVE-2026-121598","published":"2026-11-04T01:17:23.160","lastModified":"2026-11-04T01:17:23.357","description":"A security vulnerability has been detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function strcpy of the file /cgi-bin/cstecgi.cgi of the component Basic Wireless Configuration Handler. The manipulation of the argument wepkey leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-119","CWE-121"],"vendors":[],"products":[],"references":[{"url":"https://gist.github.com/H3rmesk1t/e283a4f3224cbd0a57d4392de60bd2c6","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-121598","tags":[]},{"url":"https://vuldb.com/submit/1022559","tags":[]},{"url":"https://vuldb.com/vuln/430440","tags":[]},{"url":"https://vuldb.com/vuln/430440/cti","tags":[]},{"url":"https://www.totolink.net/","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/H3rmesk1t/e283a4f3224cbd0a57d4392de60bd2c6","tags":[]}],"hasPoc":true,"ai":{"summary":"A stack-based buffer overflow in the strcpy call within the Basic Wireless Configuration Handler of TOTOLINK A950RG firmware v4.1.2cu.5268_B20221104 allows remote attackers to overwrite the stack via the 'wepkey' parameter in /cgi-bin/cstecgi.cgi, leading to potential code execution.","exploitability":"Exploitation is straightforward for authenticated low-privilege users (PR:L) over the network with no user interaction required (AV:N/AC:L/UI:N), and a public exploit exists.","blast_radius":"Successful exploitation could lead to full compromise of the device, including remote code execution, data exfiltration, and use as a pivot point within the local network.","remediation":"Upgrade to firmware version 4.1.2cu.5268_B20230101 or later (if such a patch exists); if no patched version is publicly confirmed, disable the affected 'Basic Wireless Configuration' CGI endpoint and restrict access to it via firewall rules until vendor guidance is available.","detection":"Look for HTTP POST requests to /cgi-bin/cstecgi.cgi with an unusually long 'wepkey' parameter value (>64 bytes) in web server or application logs; no reliable host-based artefact is described.","tags":["buffer-overflow","stack-smashing","cgi","iot","firmware","rce"],"model":"garnet-coder","analyzedAt":"2026-11-04T09:43:47.115Z"}}