Critical severity9.9NVD Advisory· Published Nov 4, 2026· Updated Nov 4, 2026

CVE-2026-121599

Description

A vulnerability was detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function setWiFiMultipleConfig/delWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi of the component Multi-SSID Configuration. The manipulation of the argument wepkey2/wepkey3 results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.

Affected products

Totolink/A950RGllm-fuzzy
Range: 4.1.2cu.5268_B20221104

Patches

Vulnerability mechanics

References

gist.github.com/H3rmesk1t/44673654282c9b21bc8971bab7e4b8a3nvd
vuldb.com/cve/CVE-2026-121599nvd
vuldb.com/submit/1022561nvd
vuldb.com/vuln/430441nvd
vuldb.com/vuln/430441/ctinvd
www.totolink.netnvd

News mentions

No linked articles in our index yet.

cvss	0.643
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000