Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

TOTOLINK A950RG: Unvalidated Input Can Crash or Hijack Device

CVE-2025-67189 · published 9 months ago
Summary

The TOTOLINK A950RG router has a security flaw that can cause it to crash or be taken over by a remote attacker. This is because it doesn't properly check the data sent to it, which can be exploited to cause harm. Update the router's firmware to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
totolink a950rg_firmware 4.1.2cu.5204_b20210112
cpe:2.3:o:totolink:a950rg_firmware:4.1.2cu.5204_b20210112:*:*:*:*:*:*:*
Original advisory text
A buffer overflow vulnerability exists in the setParentalRules interface of TOTOLINK A950RG V4.1.2cu.5204_B20210112. The urlKeyword parameter is not properly validated, and the function concatenate...
A buffer overflow vulnerability exists in the setParentalRules interface of TOTOLINK A950RG V4.1.2cu.5204_B20210112. The urlKeyword parameter is not properly validated, and the function concatenates multiple user-controlled fields into a fixed-size stack buffer without performing boundary checks. A remote attacker can exploit this flaw to cause denial of service or potentially achieve arbitrary code execution.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-120Classic Buffer Overflow
Timeline
Published3 Feb 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2025-67189 · NVD
Track software like this
Free during beta