Zero Radar
← feed
CriticalVulnerabilityCVE-2026-116508updated 27 Oct 2026, 01:00 UTC

TOTOLINK A950RG router can be crashed or taken over over the network

A flaw in this TOTOLINK router's web management page lets someone on the network send a specially crafted request that overflows memory. This can let an attacker crash the router or possibly run their own commands on it.

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?Not knownNo attacks reported so far
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerSends a crafted request to the router
  2. 2Web admin pageinfostat.cgi receives the CONTENT_LENGTH value
  3. 3Buffer overflowOversized input overwrites stack memory
  4. 4RouterCode execution or crash on the device
  5. ResultAttacker may control the router

What happened

A stack-based buffer overflow in the sub_402340 function of infostat.cgi (Device-Information CGI) is triggered by manipulating the CONTENT_LENGTH argument, allowing remote exploitation.

Why it is dangerous: An attacker who can reach the router's web interface can exploit the overflow remotely, potentially gaining control of the device and the home or office network behind it.

Are you affected?

You are affected if you run TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 with its web management interface reachable by untrusted users.

TOTOLINK A950RG 4.1.2cu.5268_B20221104

What to do

  1. Check whether a newer TOTOLINK firmware for the A950RG is available and install it if so
  2. Turn off remote or WAN access to the router's web admin page
  3. Restrict admin access to trusted devices only
  4. Replace the device if no fixed firmware is released

Timeline

  1. 26 Oct 2026, 22:16 UTC
    Publicly disclosed
  2. 26 Oct 2026, 22:16 UTC
    Reported by NVD · NVD
  3. 26 Oct 2026, 22:19 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 01:00 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-116508 · GHSA-5vj6-9qxv-4h93
CVSS
9.3 / 10
EPSS
0.6% chance of exploitation within 30 days
Disclosed
26 Oct 2026, 22:16 UTC
On Zero Radar
26 Oct 2026, 22:19 UTC (3 min after disclosure)
Last change
27 Oct 2026, 01:00 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

TOTOLINK A950RG router can be crashed or taken over over the network · Zero Radar