{"id":"CVE-2026-121599","published":"2026-11-04T01:17:23.413","lastModified":"2026-11-04T01:17:23.590","description":"A vulnerability was detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function setWiFiMultipleConfig/delWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi of the component Multi-SSID Configuration. The manipulation of the argument wepkey2/wepkey3 results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-119","CWE-121"],"vendors":[],"products":[],"references":[{"url":"https://gist.github.com/H3rmesk1t/44673654282c9b21bc8971bab7e4b8a3","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-121599","tags":[]},{"url":"https://vuldb.com/submit/1022561","tags":[]},{"url":"https://vuldb.com/vuln/430441","tags":[]},{"url":"https://vuldb.com/vuln/430441/cti","tags":[]},{"url":"https://www.totolink.net/","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/H3rmesk1t/44673654282c9b21bc8971bab7e4b8a3","tags":[]}],"hasPoc":true,"ai":{"summary":"A stack-based buffer overflow in the Multi-SSID Configuration endpoint of TOTOLINK A950RG firmware allows remote authenticated attackers to overwrite stack memory via malicious wepkey2/wepkey3 parameters, enabling full system compromise including data theft, tampering, and service disruption.","exploitability":"Exploitation requires valid low-privilege credentials and is straightforward now that a public exploit exists.","blast_radius":"Successful exploitation grants an attacker full control of the device, allowing lateral movement into internal networks, interception of wireless traffic, and persistent backdoor access.","remediation":"Upgrade to firmware version 4.1.2cu.5268_B20221104 patch level or later if available; otherwise, disable the Multi-SSID Configuration feature and restrict access to /cgi-bin/cstecgi.cgi until a patch is applied.","detection":"Look for HTTP POST requests to /cgi-bin/cstecgi.cgi with abnormally long wepkey2/wepkey3 values exceeding typical WEP key length limits (e.g., >64 characters), especially from authenticated but non-admin users, logged in the web server or CGI access logs.","tags":["buffer-overflow","stack-smashing","rce","iot","firmware","authenticated"],"model":"garnet-coder","analyzedAt":"2026-11-04T09:43:59.567Z"}}