CVE-2026-116507 Details
Description
A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function getLanguageCfg of the file global.so. Such manipulation of the argument token leads to information disclosure. The attack may be launched remotely. The exploit is publicly available and might be used.
An information disclosure vulnerability has been identified in the TOTOLINK A950RG router, specifically in firmware version 4.1.2cu.5268_B20221104. The issue arises in the 'getLanguageCfg' function within the 'global.so' file, where manipulation of the 'token' argument can lead to unauthorized access to sensitive information. This vulnerability can be exploited remotely, without the need for authentication or prior interaction with the device.
TOTOLINK should remove the session token from the 'getLanguageCfg' response and ensure that such sensitive information is only delivered through authenticated channels. The whitelist of topics that bypass authentication checks should be reviewed and restricted to essential functions only.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/H3rmesk1t/dd00f9b1c7b90a07c306ae369738f99f | [email protected] | ExploitRemedyTechnical Description |
| https://vuldb.com/cve/CVE-2026-116507 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1022556 | [email protected] | Permission Required |
| https://vuldb.com/vuln/426405 | [email protected] | Permission Required |
| https://vuldb.com/vuln/426405/cti | [email protected] | Content Wall |
| https://www.totolink.net/ | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TOTOLINK A950RG | V4.1.2cu.5268_B20221104 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 27, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |