External risk intelligence

TOTOLINK A950RG Router Stack Buffer Overflow

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-116508

The affected product is a router, which is an internet edge gateway device by design. The vulnerability exists within a CGI component reachable via network requests. As edge networking equipment, such devices are intentionally placed at the boundary between internal networks and the public internet, making them inherently internet-facing.

Memory Corruption

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security flaw has been identified in TOTOLINK routers, specifically impacting a CGI component that handles device information. This vulnerability, if exploited, could allow remote attackers to potentially compromise the device. The exploit is publicly available, increasing the risk of malicious use.

Flaw in router software allows remote takeover.
Routers are critical internet entry points.
Confirm if affected devices are in use.

Attack Path

How an attacker could exploit the issue

An attacker can remotely exploit this vulnerability by sending specially crafted requests to the device. This targets a specific function within the Device-Information CGI component, which handles network traffic information. By manipulating a length argument, an attacker can trigger a buffer overflow, potentially allowing them to gain control or disrupt the device's operation.

Entry condition: Unauthenticated network access.
Trigger point: Manipulating CONTENT_LENGTH argument.
Resulting risk: System control and disruption.

Live Threat

Current exploitation, exposure, and threat context

A stack-based buffer overflow vulnerability in the Device-Information CGI component could allow remote attackers to execute arbitrary code. This could potentially impact the router's functionality and expose system information when the affected `infostat.cgi` script is accessed with manipulated arguments.

Router system data could be exposed.
Exploitation may occur via network requests.
Disruption of router services is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The deployment of TOTOLINK routers as internet edge devices means that infrastructure and network/security teams are likely responsible for addressing this critical vulnerability. The immediate first step is to identify all deployed routers, assess their internet reachability and business criticality, and then confirm the accountable owner for remediation planning.

Identify all TOTOLINK router deployments.
Verify internet exposure and business criticality.
Plan risk-based remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the TOTOLINK A950RG?

The TOTOLINK A950RG is a wireless router designed to manage network traffic for homes or small offices. It serves as a gateway that connects local devices to the internet. The affected software component, Device-Information CGI, specifically manages the router's internal system data and administrative information through web-based requests.

What is a stack-based buffer overflow in CVE-2026-116508?

This is a memory corruption weakness categorized as CWE-121. It occurs when a program writes more data to a memory buffer than it is designed to hold, causing the excess information to overwrite adjacent memory. In this CVE, the vulnerability allows an attacker to corrupt the system's execution path, potentially leading to unauthorized control or service disruption.

How is this buffer overflow triggered?

The flaw is triggered by sending a specially crafted network request to the infostat.cgi component. Specifically, an attacker manipulates the CONTENT_LENGTH argument to provide more data than the function expects. Simply browsing the router's interface without intentionally crafting this specific input will not trigger the vulnerability.

Is my TOTOLINK router at risk?

According to Halo Surface Signal, this router is designed as an internet edge gateway, meaning it typically sits at the boundary between your private network and the public internet. Because the vulnerability is reachable via unauthenticated network requests, any device directly exposed to the internet is at higher risk of being targeted by remote attackers.

What should I do if I use this router?

Your first priority is to locate all TOTOLINK routers within your environment. Once identified, evaluate their connection to the internet and determine how critical they are to your daily operations. You should then work with the accountable team to plan for remediation or restricted access, as this device's role as a network gateway makes securing it a high priority.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.