CVE-2026-116508: TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow
Received
Published 26-10-2026Last modified 26-10-2026
Vulnerability summary
CVE-2026-116508 is a critical (CVSS 10.0) vulnerability in totolink a950rg. 1 public exploit is recorded.
CVSS score
10.0/10
010
Critical · v4.0 (CVE.org)EPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github
Timeline
- 26-10-2026PublishedVulnerability first disclosed.
Description
A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument CONTENT_LENGTH results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
CVSS metrics
7 scores · 2 sources · 4 versionsCritical 10.0Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:PSources2 sources · 9.3–10.0
- NVDNIST9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
Critical 10.0Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:RSourcesAll 2 agree
- NVDNIST10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Critical 10.0Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:RSourcesSingle source
High 10.0Preferred score · CVE.org (CNA)
AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:URSourcesAll 2 agree
- NVDNIST10.0HighAV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundAd72Def4Ccc232757D4Cbabf45Da72Cb
Maturity: poc
Weaknesses
CWE · root cause- CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
- CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Affected systems
Totolink1 product
- a950rg4.1.2cu.5268_B20221104
1 vendor · 1 product
References
6 links- vuldb.com/cve/CVE-2026-116508Third Party Advisory
- vuldb.com/submit/1022557Third Party Advisory
- www.totolink.netProduct