CVE-2026-116507: TOTOLINK A950RG global.so getLanguageCfg information disclosure
Received
Published 26-10-2026Last modified 26-10-2026
Vulnerability summary
CVE-2026-116507 is a medium (CVSS 6.9) vulnerability in totolink a950rg. 1 public exploit is recorded.
CVSS score
6.9/10
010
Medium · v4.0 (CVE.org)EPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github
Timeline
- 26-10-2026PublishedVulnerability first disclosed.
Description
A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function getLanguageCfg of the file global.so. Such manipulation of the argument token leads to information disclosure. The attack may be launched remotely. The exploit is publicly available and might be used.
CVSS metrics
7 scores · 2 sources · 4 versionsMedium 6.9Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:PSources2 sources · 5.5–6.9
- NVDNIST5.5MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
Medium 5.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:RSourcesAll 2 agree
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Medium 5.3Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:RSourcesSingle source
Medium 5.0Preferred score · CVE.org (CNA)
AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:URSourcesAll 2 agree
- NVDNIST5.0MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundDd00F9B1C7B90A07C306Ae369738F99F
Maturity: poc
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Affected systems
Totolink1 product
- a950rg4.1.2cu.5268_B20221104
1 vendor · 1 product
References
6 links- vuldb.com/cve/CVE-2026-116507Third Party Advisory
- vuldb.com/submit/1022556Third Party Advisory
- www.totolink.netProduct