Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument CONTENT_LENGTH results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
ExploitGrid Daily Digest 🚨 Top CVEs: CVE-2026-115905 (CVSS: 10) zip-rs CVE-2026-116508 (CVSS: 10) totolink CVE-2026-102649 (CVSS: 9.9) padok-team CVE-2026-110720 (CVSS: 9.9) HashiCorp CVE-2026-115188 (CVSS: 9.9) ..🧵👇
[CVE] CVE-2026-116508 [HIGH PRIORITY] CVSS: 10 | Vendor: #totolink #TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based ov... 🔗 https://exploitgrid.net/cve/CVE-2026-116508
TOTOLINK A950RG — 5 CVEs, two at 10.0, no patch. 10.0 #1: Auth gate checks if routing key *contains* the handler name. Attacker controls the key. 10.0 #2: infostat.cgi skips auth entirely. No PIE, no canary, ASLR off. ROP published. https://threataft.com/articles/totolink-a950rg-cluster-cve-2026-116508-114575 #TOTOLINK #CVE