10.0
CriticalCVSS 3.1 · from VulDB
CVE-2026-116508
TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow
A950RG · Stack buffer overflow · CWE-121AffectedA950RG
FixNo fix listed yet.
PublishedOct 26, 21:30 · VulDB
ScoredOct 26 · 10.0 · VulDB
Exploit code publicNone known · checked 22:18 UTC
ExploitedNone known · CISA KEV checked 22:30 UTC
What we know
No known exploitation. CISA KEV, checked 22:30 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 22:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument CONTENT_LENGTH results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
From VulDB
Affected and fixed versions
ProductAffectedFixed inA950RG4.1.2cu.5268_B20221104–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known