PT-2026-5957 · Totolink · Totolink A950Rg

Published 2026-02-03 · Updated 2026-02-10 · CVE-2025-67189

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK A950RG version 4.1.2cu.5204 B20210112

Description A buffer overflow issue exists in the setParentalRules interface. The urlKeyword parameter does not undergo proper validation. The system concatenates multiple user-supplied values into a fixed-size stack buffer without sufficient boundary checks. This can allow a remote attacker to cause a denial of service or potentially execute arbitrary code. The vulnerable function is setParentalRules. The vulnerable parameter is urlKeyword.

Recommendations Update TOTOLINK A950RG to a version newer than 4.1.2cu.5204 B20210112.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2025-67189

Affected Products

Totolink A950Rg

References · 4

• 🔥 https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A950RG/5024-setParentRules-urlKeyWord-buffer.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-67189 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67189 · Vendor Advisory
• https://t.me/cveNotify/151550 · Telegram Post