TI-2026-84910 Aliases CVE-2026-121600 GHSA-3qmv-h4hw-rjxv

Stack-based buffer overflow in TOTOLINK A950RG MAC filter handler

MEDIUM 41CWE-119Published 2026-11-04 · Updated 2026-11-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

TOTOLINK A950RG from 4.1.2cu.5268_B20221104 contains a stack-based buffer overflow (CWE-121) in its MAC Filter handler. Manipulating the addEffect argument of the setMacFilterRules function in /cgi-bin/cstecgi.cgi triggers the overflow. A remote attacker with low privileges can exploit it over the network. A public exploit has been published.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component MAC Filter Handler. This manipulation of the argument addEffect causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.

Why it matters now

EPSS 0.00466 40th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TOTOLINK	A950RG	4.1.2cu.5268_B20221104	—	No fix listed	CNA

A950RG VendorTOTOLINK Affected 4.1.2cu.5268_B20221104 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:o:totolink:a950rg_firmware::::::::	—	—	TOTOLINK

cpe:2.3:o:totolink:a950rg_firmware:*:*:*:*:*:*:*:* Versions — — ·TOTOLINK

Remediation

The sources list no fixed version for TOTOLINK A950RG.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Timeline

2026-11-04 Threatist record created from CVE-2026-121600
2026-11-04 Alias added: GHSA-3qmv-h4hw-rjxv

References

Exploit 1

https://gist.github.com/H3rmesk1t/217c00b12e04fcde07c453a55579f808

Other 1

https://www.totolink.net/

TI-2023-25090 An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute… CVSS 3.1CRITICAL 9.8
TI-2026-80926 TOTOLINK A950RG stack-based overflow in infostat.cgi via CONTENT_LENGTH CVSS 4.0CRITICAL 10.0
TI-2026-79142 Command injection in TOTOLINK A950RG UploadCustomModule function CVSS 4.0CRITICAL 10.0
TI-2026-79031 TOTOLINK EX200 setWiFiAclAddConfig stack-based buffer overflow CVSS 4.0CRITICAL 10.0
TI-2026-79012 Stack-based buffer overflow in TOTOLINK EX200 setStaticDhcpConfig CVSS 4.0CRITICAL 10.0
TI-2026-67719 Stack-based overflow in Totolink A3002MU QoS rule handler CVSS 4.0CRITICAL 10.0

See all 1321 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences