CVE-2026-121599

Summary

A stack-based buffer overflow in the Multi-SSID Configuration endpoint of TOTOLINK A950RG firmware allows remote authenticated attackers to overwrite stack memory via malicious wepkey2/wepkey3 parameters, enabling full system compromise including data theft, tampering, and service disruption.

Exploitability

Exploitation requires valid low-privilege credentials and is straightforward now that a public exploit exists.

Blast radius

Successful exploitation grants an attacker full control of the device, allowing lateral movement into internal networks, interception of wireless traffic, and persistent backdoor access.

Detection

Look for HTTP POST requests to /cgi-bin/cstecgi.cgi with abnormally long wepkey2/wepkey3 values exceeding typical WEP key length limits (e.g., >64 characters), especially from authenticated but non-admin users, logged in the web server or CGI access logs.

Prioritized remediation

Upgrade to firmware version 4.1.2cu.5268_B20221104 patch level or later if available; otherwise, disable the Multi-SSID Configuration feature and restrict access to /cgi-bin/cstecgi.cgi until a patch is applied.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.