CVE-2026-121600 Details
Description
A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component MAC Filter Handler. This manipulation of the argument addEffect causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.
A stack-based buffer overflow vulnerability has been identified in the TOTOLINK A950RG router, specifically in firmware version 4.1.2cu.5268_B20221104. The issue arises in the MAC filter handler function 'setMacFilterRules' within the file '/cgi-bin/cstecgi.cgi'. The vulnerability can be exploited remotely by manipulating the 'addEffect' argument, leading to unbounded writes into stack buffers. This flaw allows for overwriting of the saved return address, potentially enabling arbitrary code execution.
The vulnerability can be addressed by implementing proper bounds checking on the 'macAddress' and 'comment' fields in the 'setMacFilterRules' function. The MAC address should be validated to ensure it does not exceed 17 characters, and the comment field should be restricted to a reasonable maximum length and a printable character set.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/H3rmesk1t/217c00b12e04fcde07c453a55579f808 | [email protected] | ExploitTechnical Description |
| https://vuldb.com/cve/CVE-2026-121600 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1022562 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/430442 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/430442/cti | [email protected] | Content Wall |
| https://www.totolink.net/ | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TOTOLINK A950RG | V4.1.2cu.5268_B20221104 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | [email protected] |