CVE-2026-116507
TOTOLINK A950RG global.so getLanguageCfg information disclosure
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 26, 2026
- Updated
- Oct 27, 2026
- Reserved
- Oct 26, 2026
Description
A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function getLanguageCfg of the file global.so. Such manipulation of the argument token leads to information disclosure. The attack may be launched remotely. The exploit is publicly available and might be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 5.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 5.0 Medium | AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
A950RGTOTOLINK |
|
References
- VDB-426405 | TOTOLINK A950RG global.so getLanguageCfg information disclosurevdb-entrytechnical-description
- VDB-426405 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-116507 | CVE Analysis and Reportthird-party-advisory
- Submit #1022556 | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Information Disclosurethird-party-advisory
- https://gist.github.com/H3rmesk1t/dd00f9b1c7b90a07c306ae369738f99fexploit
- https://www.totolink.net/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.