# CVE-2026-121597: TOTOLINK A950RG stack buffer overflow in Easy Setup Wizard

Source: https://junglewise.ai/threats/cve-2026-121597-a-weakness-has-been-identified-in-totolink-a950rg-4-1-2cu-5268  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-121597 · Severity: critical · CVSS 9.9 · Published 2026-11-04

The TOTOLINK A950RG router's Easy Setup Wizard feature contains a stack buffer overflow vulnerability in the /cgi-bin/cstecgi.cgi handler that can be exploited remotely by an authenticated user. An attacker can overflow a 12-byte buffer by sending oversized wireless SSID parameters, overwriting the function return address and achieving arbitrary code execution on the device. Since the router discloses session tokens without authentication via another vulnerability (A950RG-INFO-01), the effective attack requires no authentication, allowing complete device compromise.

Technologies: [TOTOLINK A950rg](https://junglewise.ai/threats/technologies/a950rg). Vendors: [TOTOLINK](https://junglewise.ai/threats/vendors/totolink).

## Quick answers

**Is CVE-2026-121597 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121597 being exploited in the wild.

**How severe is CVE-2026-121597?** Critical severity, with a CVSS score of 9.9, published 4 November 2026.

**Which products and versions are affected?** TOTOLINK A950rg 4.1.2cu.5268_B20221104.

**Is there a fix for CVE-2026-121597?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-121597 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-121597?** Check whether you run TOTOLINK A950rg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow (CWE-121) exists in the setAppEasyWizardConfig function of lib/cste_modules/app.so when processing rootSsid and apcliSsid parameters via POST to /cgi-bin/cstecgi.cgi. The handler copies user-supplied SSID values into a 12-byte local buffer using unsafe functions (strcpy, sprintf) without length validation; a 157-byte payload overwrites the saved return address. The target is non-PIE with no stack canary and ASLR disabled, enabling fixed-address ROP/shellcode execution; exploitation is possible without authentication when chained with info disclosure vulnerability A950RG-INFO-01.

## Affected products

- TOTOLINK A950RG 4.1.2cu.5268_B20221104

## Timeline

- 2026-11-04: disclosed

## References

- [https://gist.github.com/H3rmesk1t/49d6ccded59379651568e0bdc6b5624c](https://gist.github.com/H3rmesk1t/49d6ccded59379651568e0bdc6b5624c)
- [https://vuldb.com/cve/CVE-2026-121597](https://vuldb.com/cve/CVE-2026-121597)

## Related threats

- [TOTOLINK A950RG stack buffer overflow in MAC filter handler](https://junglewise.ai/threats/cve-2026-121600-a-flaw-has-been-found-in-totolink-a950rg-4-1-2cu-5268-b20221104)
- [TOTOLINK A950RG stack buffer overflow in WiFi configuration](https://junglewise.ai/threats/cve-2026-121599-a-vulnerability-was-detected-in-totolink-a950rg-4-1-2cu-5268)
- [TOTOLINK A950RG stack buffer overflow in wireless configuration](https://junglewise.ai/threats/cve-2026-121598-a-security-vulnerability-has-been-detected-in-totolink-a950rg-4)
- [TOTOLINK A950RG stack buffer overflow in infostat.cgi](https://junglewise.ai/threats/cve-2026-116508-a-security-flaw-has-been-discovered-in-totolink-a950rg-4-1-2cu)
- [TOTOLINK A950RG information disclosure in getLanguageCfg](https://junglewise.ai/threats/cve-2026-116507-a-vulnerability-was-identified-in-totolink-a950rg-4-1-2cu-5268)