CVE-2026-121599

EUVD-2026-116668
A vulnerability was detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function setWiFiMultipleConfig/delWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi of the component Multi-SSID Configuration. The manipulation of the argument wepkey2/wepkey3 results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.9 CRITICAL
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 40.49%
Common Weakness Enumeration
References
https://gist.github.com/H3rmesk1t/44673654282c9b21bc8971bab7e4b8a3
https://vuldb.com/cve/CVE-2026-121599
https://vuldb.com/submit/1022561
https://vuldb.com/vuln/430441
https://vuldb.com/vuln/430441/cti
https://www.totolink.net/