TOTOLINK A950RG: Stack-based buffer overflow in infostat.cgi
Summary
A stack-based buffer overflow in the Device-Information CGI (infostat.cgi, function sub_402340) of the TOTOLINK A950RG router firmware 4.1.2cu.5268_B20221104 can be triggered by manipulating the Content-Length header. An attacker who can reach the device's web interface can send a crafted request without a valid session, which can crash the device or potentially lead to code execution. A public exploit has been released.
Affected
- TOTOLINK A950RG, firmware 4.1.2cu.5268_B20221104
- Other firmware versions: Unknown.
Fixed in
Unknown. No fixed version has been published.
Workaround
- No vendor mitigation is documented.
- Restrict access to the web and management interface to the LAN or to specific trusted IP addresses.
- Do not expose the device's web interface to the internet.
Exploitation
- A public proof-of-concept exploit has been published.
- Exploitation in the wild: Unknown.
- Not listed in the CISA KEV catalogue.
Our recommendation
- Check whether any A950RG device runs this firmware and whether its web interface is reachable from untrusted networks.
- Remove WAN access to the management interface and restrict admin access to a management network.
- Monitor the device for signs of compromise and treat it as possibly compromised if it was exposed.
- Plan to replace the device if no fixed firmware is released, as the firmware dates from 2022 and no support statement was found.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB CVE-2026-116508 vuldb.com
- VulDB vulnerability 426406 vuldb.com
- GitHub gist: TOTOLINK A950RG stack buffer overflow in infostat.cgi gist.github.com
- OffSeq Radar: CVE-2026-116508 radar.offseq.com
- HOL Guard: CVE-2026-116508 hol.org
- OpenCVE: CVE-2026-116508 app.opencve.io
- TOTOLINK website www.totolink.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:40.
Original description (NVD)
A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument CONTENT_LENGTH results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.