---
id: CVE-2026-116507
title: TOTOLINK A950RG global.so getLanguageCfg information disclosure
summary: >-
  A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104.
  Affected by this vulnerability is the function getLanguageCfg of the file
  global.so. Such manipulation of the argument token leads to information
  disclosure. The a…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'
cvssSource: cna
cwe:
  - CWE-200
  - CWE-284
vendor: TOTOLINK
product: A950RG
affected:
  - A950RG 4.1.2cu.5268_B20221104
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-27T13:57:57.220628Z'
exploitAvailable: true
published: '2026-10-26'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T14:17:44.541Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116507'
references:
  - url: 'https://vuldb.com/vuln/426405'
    label: >-
      VDB-426405 | TOTOLINK A950RG global.so getLanguageCfg information
      disclosure
  - url: 'https://vuldb.com/vuln/426405/cti'
    label: 'VDB-426405 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-116507'
    label: CVE-2026-116507 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1022556'
    label: >-
      Submit #1022556 | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Information
      Disclosure
  - url: 'https://gist.github.com/H3rmesk1t/dd00f9b1c7b90a07c306ae369738f99f'
  - url: 'https://www.totolink.net/'
tags:
  - cve.org
  - exploit-available
epss: 0.00396
epssPercentile: 0.34007
ingestedAt: '2026-10-27T16:11:59.455Z'
---

## Overview

A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function getLanguageCfg of the file global.so. Such manipulation of the argument token leads to information disclosure. The attack may be launched remotely. The exploit is publicly available and might be used.

## Affected

- `A950RG 4.1.2cu.5268_B20221104`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.