Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-116508: TOTOLINK A950RG router allows remote code execution via web request
CVE-2026-116508 · published 1 day ago
Summary
The router’s web interface has a bug that can be triggered by sending a specially crafted request, causing the device to overflow its memory. An attacker could take control of the router from anywhere on the internet. Apply the latest firmware update from the vendor as soon as possible or block external access to the router’s management pages.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| totolink | a950rg | 4.1.2cu.5268_B20221104 |
Original advisory text
TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow
A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument CONTENT_LENGTH results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
9.3
Critical
Type
CWE-121Stack-based Buffer Overflow
CWE-119Buffer Overflow
Timeline
Published26 Oct 2026
Updated27 Oct 2026
First seen26 Oct 2026
Track software like this
Free during beta