Is CVE-2026-116508 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116508 being exploited in the wild.

How severe is CVE-2026-116508?

Critical severity, with a CVSS score of 10, published 26 October 2026.

Which products and versions are affected?

TOTOLINK A950rg 4.1.2cu.5268_B20221104.

Is there a fix for CVE-2026-116508?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-116508 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-116508?

Check whether you run TOTOLINK A950rg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116508: TOTOLINK A950RG stack buffer overflow in infostat.cgi

CVE-2026-116508 · Severity: critical · CVSS 10 · Published 2026-10-26

The TOTOLINK A950RG router's device-information interface fails to validate the size of incoming HTTP requests, allowing an attacker on the network to overflow internal memory buffers and execute arbitrary code. Since no authentication is required, any user with network access to the router can trigger the vulnerability to completely compromise the device.

Technologies: TOTOLINK A950rg. Vendors: TOTOLINK.

Quick answers

Is CVE-2026-116508 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116508 being exploited in the wild.
How severe is CVE-2026-116508?: Critical severity, with a CVSS score of 10, published 26 October 2026.
Which products and versions are affected?: TOTOLINK A950rg 4.1.2cu.5268_B20221104.
Is there a fix for CVE-2026-116508?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-116508 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-116508?: Check whether you run TOTOLINK A950rg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unauthenticated stack-based buffer overflow in the infostat.cgi CGI handler results from improper use of the Content-Length HTTP header: the program reads request bodies directly into a 4096-byte stack buffer without bounds checking, and a second strcpy in sub_402340 introduces a third overflow point. The attack is network-accessible without credentials, and the target firmware (non-PIE, no stack canaries, ASLR disabled) allows reliable exploitation to achieve remote code execution or denial of service.

Affected products

TOTOLINK A950RG 4.1.2cu.5268_B20221104

Timeline

2026-10-26: disclosed
2026-10-10: exploited: Exploit code published on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.