Common Weakness Enumeration
CWE-121
AllowedStack-based Buffer Overflow
Abstraction: Variant · Status: Draft
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
3361 vulnerabilities reference this CWE, most recent first.
CVE-2026-121600 (GCVE-0-2026-121600)
Vulnerability from cvelistv5 – Published: 2026-11-04 00:45 – Updated: 2026-11-09 15:59
VLAI
EPSS
VEX
Title
TOTOLINK A950RG MAC Filter cstecgi.cgi setMacFilterRules stack-based overflow
Summary
A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component MAC Filter Handler. This manipulation of the argument addEffect causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.
Severity
9.9 (Critical)
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 15:58 UTC
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/430442 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/430442/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121600 | third-party-advisory |
| https://vuldb.com/submit/1022562 | third-party-advisory |
| https://gist.github.com/H3rmesk1t/217c00b12e04fcd… | exploit |
| https://www.totolink.net/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121600",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T15:58:37.357760Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T15:59:16.457Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:totolink:a950rg_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"MAC Filter Handler"
],
"product": "A950RG",
"vendor": "TOTOLINK",
"versions": [
{
"status": "affected",
"version": "4.1.2cu.5268_B20221104"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "LiuYijun_JX.SGCC (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component MAC Filter Handler. This manipulation of the argument addEffect causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T00:45:35.387Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-430442 | TOTOLINK A950RG MAC Filter cstecgi.cgi setMacFilterRules stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/430442"
},
{
"name": "VDB-430442 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/430442/cti"
},
{
"name": "CVE-2026-121600 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121600"
},
{
"name": "Submit #1022562 | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Stack Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1022562"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/H3rmesk1t/217c00b12e04fcde07c453a55579f808"
},
{
"tags": [
"product"
],
"url": "https://www.totolink.net/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-03T17:19:58.000Z",
"value": "VulDB entry last update"
}
],
"title": "TOTOLINK A950RG MAC Filter cstecgi.cgi setMacFilterRules stack-based overflow",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121600",
"datePublished": "2026-11-04T00:45:35.387Z",
"dateReserved": "2026-11-03T16:14:39.060Z",
"dateUpdated": "2026-11-09T15:59:16.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121599 (GCVE-0-2026-121599)
Vulnerability from cvelistv5 – Published: 2026-11-04 00:30 – Updated: 2026-11-07 03:40
VLAI
EPSS
VEX
Title
TOTOLINK A950RG Multi-SSID Configuration cstecgi.cgi delWiFiMultipleConfig stack-based overflow
Summary
A vulnerability was detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function setWiFiMultipleConfig/delWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi of the component Multi-SSID Configuration. The manipulation of the argument wepkey2/wepkey3 results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.
Severity
9.9 (Critical)
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-07 03:39 UTC
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/430441 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/430441/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121599 | third-party-advisory |
| https://vuldb.com/submit/1022561 | third-party-advisory |
| https://gist.github.com/H3rmesk1t/44673654282c9b2… | exploit |
| https://www.totolink.net/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121599",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T03:39:50.484698Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T03:40:07.092Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:totolink:a950rg_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"Multi-SSID Configuration"
],
"product": "A950RG",
"vendor": "TOTOLINK",
"versions": [
{
"status": "affected",
"version": "4.1.2cu.5268_B20221104"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "LiuYijun_JX.SGCC (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function setWiFiMultipleConfig/delWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi of the component Multi-SSID Configuration. The manipulation of the argument wepkey2/wepkey3 results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T00:30:26.769Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-430441 | TOTOLINK A950RG Multi-SSID Configuration cstecgi.cgi delWiFiMultipleConfig stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/430441"
},
{
"name": "VDB-430441 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/430441/cti"
},
{
"name": "CVE-2026-121599 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121599"
},
{
"name": "Submit #1022561 | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Stack Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1022561"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/H3rmesk1t/44673654282c9b21bc8971bab7e4b8a3"
},
{
"tags": [
"product"
],
"url": "https://www.totolink.net/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-03T17:19:54.000Z",
"value": "VulDB entry last update"
}
],
"title": "TOTOLINK A950RG Multi-SSID Configuration cstecgi.cgi delWiFiMultipleConfig stack-based overflow",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121599",
"datePublished": "2026-11-04T00:30:26.769Z",
"dateReserved": "2026-11-03T16:14:35.174Z",
"dateUpdated": "2026-11-07T03:40:07.092Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121598 (GCVE-0-2026-121598)
Vulnerability from cvelistv5 – Published: 2026-11-04 00:15 – Updated: 2026-11-04 18:59
VLAI
EPSS
VEX
Title
TOTOLINK A950RG Basic Wireless Configuration cstecgi.cgi strcpy stack-based overflow
Summary
A security vulnerability has been detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function strcpy of the file /cgi-bin/cstecgi.cgi of the component Basic Wireless Configuration Handler. The manipulation of the argument wepkey leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Severity
9.9 (Critical)
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 18:59 UTC
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/430440 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/430440/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121598 | third-party-advisory |
| https://vuldb.com/submit/1022559 | third-party-advisory |
| https://gist.github.com/H3rmesk1t/e283a4f3224cbd0… | exploit |
| https://www.totolink.net/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121598",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T18:59:00.937916Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T18:59:12.828Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:totolink:a950rg_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Wireless Configuration Handler"
],
"product": "A950RG",
"vendor": "TOTOLINK",
"versions": [
{
"status": "affected",
"version": "4.1.2cu.5268_B20221104"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "LiuYijun_JX.SGCC (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function strcpy of the file /cgi-bin/cstecgi.cgi of the component Basic Wireless Configuration Handler. The manipulation of the argument wepkey leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T00:15:14.857Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-430440 | TOTOLINK A950RG Basic Wireless Configuration cstecgi.cgi strcpy stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/430440"
},
{
"name": "VDB-430440 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/430440/cti"
},
{
"name": "CVE-2026-121598 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121598"
},
{
"name": "Submit #1022559 | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Stack Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1022559"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/H3rmesk1t/e283a4f3224cbd0a57d4392de60bd2c6"
},
{
"tags": [
"product"
],
"url": "https://www.totolink.net/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-03T17:19:50.000Z",
"value": "VulDB entry last update"
}
],
"title": "TOTOLINK A950RG Basic Wireless Configuration cstecgi.cgi strcpy stack-based overflow",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121598",
"datePublished": "2026-11-04T00:15:14.857Z",
"dateReserved": "2026-11-03T16:14:31.726Z",
"dateUpdated": "2026-11-04T18:59:12.828Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121597 (GCVE-0-2026-121597)
Vulnerability from cvelistv5 – Published: 2026-11-04 00:00 – Updated: 2026-11-09 17:00
VLAI
EPSS
VEX
Title
TOTOLINK A950RG Easy Setup Wizard cstecgi.cgi setAppEasyWizardConfig stack-based overflow
Summary
A weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setAppEasyWizardConfig of the file /cgi-bin/cstecgi.cgi of the component Easy Setup Wizard Handler. Executing a manipulation of the argument functionType can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Severity
9.9 (Critical)
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 16:36 UTC
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/430439 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/430439/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121597 | third-party-advisory |
| https://vuldb.com/submit/1022558 | third-party-advisory |
| https://gist.github.com/H3rmesk1t/49d6ccded593796… | exploit |
| https://www.totolink.net/ | broken-linkproduct |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121597",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T16:36:00.343096Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:00:16.123Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:totolink:a950rg_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"Easy Setup Wizard Handler"
],
"product": "A950RG",
"vendor": "TOTOLINK",
"versions": [
{
"status": "affected",
"version": "4.1.2cu.5268_B20221104"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "LiuYijun_JX.SGCC (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setAppEasyWizardConfig of the file /cgi-bin/cstecgi.cgi of the component Easy Setup Wizard Handler. Executing a manipulation of the argument functionType can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T00:00:30.063Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-430439 | TOTOLINK A950RG Easy Setup Wizard cstecgi.cgi setAppEasyWizardConfig stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/430439"
},
{
"name": "VDB-430439 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/430439/cti"
},
{
"name": "CVE-2026-121597 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121597"
},
{
"name": "Submit #1022558 | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Stack Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1022558"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/H3rmesk1t/49d6ccded59379651568e0bdc6b5624c"
},
{
"tags": [
"broken-link",
"product"
],
"url": "https://www.totolink.net/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-03T17:19:46.000Z",
"value": "VulDB entry last update"
}
],
"title": "TOTOLINK A950RG Easy Setup Wizard cstecgi.cgi setAppEasyWizardConfig stack-based overflow",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121597",
"datePublished": "2026-11-04T00:00:30.063Z",
"dateReserved": "2026-11-03T16:14:27.923Z",
"dateUpdated": "2026-11-09T17:00:16.123Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120752 (GCVE-0-2026-120752)
Vulnerability from cvelistv5 – Published: 2026-11-02 22:16 – Updated: 2026-11-07 02:27
VLAI
EPSS
VEX
Title
PyMuPDF 1.25.3 before 2.0 Stack Buffer Overflow via add_freetext_annot() Callout
Summary
PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.add_freetext_annot() can supply four or more points to overwrite the stack frame, crashing the process or executing code.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-07 02:26 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/pymupdf/PyMuPDF/issues/5112 | issue-tracking |
| https://github.com/pymupdf/PyMuPDF/issues/5173 | issue-trackingtechnical-description |
| https://github.com/pymupdf/PyMuPDF/commit/d4298ea… | patch |
| https://github.com/pymupdf/PyMuPDF/blob/1.28.2/sr… | technical-description |
| https://github.com/pymupdf/PyMuPDF/releases/tag/2.0 | release-notes |
| https://github.com/pymupdf/PyMuPDF | product |
| https://www.vulncheck.com/advisories/pymupdf-1.25… | third-party-advisory |
Impacted products
Date Public
2026-09-07 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120752",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T02:26:40.474256Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T02:27:07.671Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pymupdf/PyMuPDF/issues/5112"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/pymupdf",
"product": "PyMuPDF",
"repo": "https://github.com/pymupdf/PyMuPDF",
"vendor": "PyMuPDF",
"versions": [
{
"lessThan": "2.0",
"status": "affected",
"version": "1.25.3",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "k3rn3lbr3ach3r"
},
{
"lang": "en",
"type": "analyst",
"value": "Dilanka Kaushal Hewage (r3vpwnx)"
}
],
"datePublic": "2026-09-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.add_freetext_annot() can supply four or more points to overwrite the stack frame, crashing the process or executing code."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T22:16:12.885Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #5112",
"tags": [
"issue-tracking"
],
"url": "https://github.com/pymupdf/PyMuPDF/issues/5112"
},
{
"name": "GitHub Issue #5173",
"tags": [
"issue-tracking",
"technical-description"
],
"url": "https://github.com/pymupdf/PyMuPDF/issues/5173"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pymupdf/PyMuPDF/commit/d4298ead84ceeae1c9065c81cd9a275a1b092f5e"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pymupdf/PyMuPDF/blob/1.28.2/src/extra.i#L787-L797"
},
{
"name": "PyMuPDF 2.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/pymupdf/PyMuPDF/releases/tag/2.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/pymupdf/PyMuPDF"
},
{
"name": "VulnCheck Advisory: PyMuPDF 1.25.3 before 2.0 Stack Buffer Overflow via add_freetext_annot() Callout",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pymupdf-1.25.3-before-2.0-stack-buffer-overflow-via-add-freetext-annot-callout"
}
],
"title": "PyMuPDF 1.25.3 before 2.0 Stack Buffer Overflow via add_freetext_annot() Callout",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120752",
"datePublished": "2026-11-02T22:16:12.885Z",
"dateReserved": "2026-11-02T21:08:16.717Z",
"dateUpdated": "2026-11-07T02:27:07.671Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120434 (GCVE-0-2026-120434)
Vulnerability from cvelistv5 – Published: 2026-11-02 14:28 – Updated: 2026-11-05 21:36
VLAI
EPSS
VEX
Title
Netpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Overflow via scanPoly
Summary
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in picttoppm's scanPoly() function in converter/ppm/picttoppm.c. Attackers can supply a crafted PICT file whose polygon edges produce more than 5000 points, overflowing the coord stack array to crash the converter or potentially execute code.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:36 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://sourceforge.net/p/netpbm/code/5331/ | patch |
| https://svn.code.sf.net/p/netpbm/code/!svn/bc/535… | release-notes |
| https://svn.code.sf.net/p/netpbm/code/!svn/bc/535… | release-notes |
| https://svn.code.sf.net/p/netpbm/code/!svn/bc/537… | release-notes |
| https://svn.code.sf.net/p/netpbm/code/!svn/bc/533… | technical-description |
| https://www.vulncheck.com/advisories/netpbm-befor… | third-party-advisory |
Impacted products
Date Public
2026-09-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120434",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:36:39.154661Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:36:56.064Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Netpbm",
"vendor": "Netpbm",
"versions": [
{
"lessThan": "10.86.51",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "11.02.30",
"status": "affected",
"version": "11.0",
"versionType": "custom"
},
{
"lessThan": "11.15.08",
"status": "affected",
"version": "11.03",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netpbm_project:netpbm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.86.51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netpbm_project:netpbm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.02.30",
"versionStartIncluding": "11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netpbm_project:netpbm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.15.08",
"versionStartIncluding": "11.03",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tristan Madani (Talence Security)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Bryan Henderson"
}
],
"datePublic": "2026-09-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in picttoppm\u0027s scanPoly() function in converter/ppm/picttoppm.c. Attackers can supply a crafted PICT file whose polygon edges produce more than 5000 points, overflowing the coord stack array to crash the converter or potentially execute code."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:28:57.796Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://sourceforge.net/p/netpbm/code/5331/"
},
{
"tags": [
"release-notes"
],
"url": "https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY"
},
{
"tags": [
"release-notes"
],
"url": "https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY"
},
{
"tags": [
"release-notes"
],
"url": "https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY"
},
{
"tags": [
"technical-description"
],
"url": "https://svn.code.sf.net/p/netpbm/code/!svn/bc/5330/trunk/converter/ppm/picttoppm.c"
},
{
"name": "VulnCheck Advisory: Netpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Overflow via scanPoly",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-picttoppm-stack-overflow-via-scanpoly"
}
],
"title": "Netpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Overflow via scanPoly",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120434",
"datePublished": "2026-11-02T14:28:57.796Z",
"dateReserved": "2026-11-02T12:42:13.492Z",
"dateUpdated": "2026-11-05T21:36:56.064Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120433 (GCVE-0-2026-120433)
Vulnerability from cvelistv5 – Published: 2026-11-02 14:28 – Updated: 2026-11-02 16:05
VLAI
EPSS
VEX
Title
Netpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Buffer Overflow via paintPoly
Summary
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly() function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array, causing crashes or potentially code execution.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 16:05 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://sourceforge.net/p/netpbm/code/5328/ | patch |
| https://svn.code.sf.net/p/netpbm/code/!svn/bc/535… | release-notes |
| https://svn.code.sf.net/p/netpbm/code/!svn/bc/535… | release-notes |
| https://svn.code.sf.net/p/netpbm/code/!svn/bc/537… | release-notes |
| https://svn.code.sf.net/p/netpbm/code/!svn/bc/532… | technical-description |
| https://www.vulncheck.com/advisories/netpbm-befor… | third-party-advisory |
Impacted products
Date Public
2026-09-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120433",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T16:05:35.509455Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T16:05:59.533Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Netpbm",
"vendor": "Netpbm",
"versions": [
{
"lessThan": "10.86.51",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "11.02.30",
"status": "affected",
"version": "11.0",
"versionType": "custom"
},
{
"lessThan": "11.15.08",
"status": "affected",
"version": "11.03",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netpbm_project:netpbm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.86.51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netpbm_project:netpbm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.02.30",
"versionStartIncluding": "11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netpbm_project:netpbm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.15.08",
"versionStartIncluding": "11.03",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tristan Madani (Talence Security)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Bryan Henderson"
}
],
"datePublic": "2026-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly() function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array, causing crashes or potentially code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:28:57.113Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://sourceforge.net/p/netpbm/code/5328/"
},
{
"tags": [
"release-notes"
],
"url": "https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY"
},
{
"tags": [
"release-notes"
],
"url": "https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY"
},
{
"tags": [
"release-notes"
],
"url": "https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY"
},
{
"tags": [
"technical-description"
],
"url": "https://svn.code.sf.net/p/netpbm/code/!svn/bc/5327/trunk/converter/ppm/picttoppm.c"
},
{
"name": "VulnCheck Advisory: Netpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Buffer Overflow via paintPoly",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-picttoppm-stack-buffer-overflow-via-paintpoly"
}
],
"title": "Netpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Buffer Overflow via paintPoly",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120433",
"datePublished": "2026-11-02T14:28:57.113Z",
"dateReserved": "2026-11-02T12:42:13.117Z",
"dateUpdated": "2026-11-02T16:05:59.533Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120336 (GCVE-0-2026-120336)
Vulnerability from cvelistv5 – Published: 2026-11-02 03:15 – Updated: 2026-11-05 16:03
VLAI
EPSS
VEX
Title
VStarcam O-KAM Client DevDll_925.dll FUN_10003EA0 stack-based overflow
Summary
A vulnerability was found in VStarcam O-KAM Client 1.3.3.32. Affected by this vulnerability is the function FUN_10003EA0 in the library DevDll_925.dll. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 16:03 UTC
Assigner
VulDB
CNA
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/429661 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/429661/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-120336 | third-party-advisory |
| https://vuldb.com/submit/1016301 | third-party-advisory |
| https://gist.github.com/Ishanoshada/f6345a42a46e1… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| VStarcam | O-KAM Client |
Affected:
1.3.3.32
cpe:2.3:a:vstarcam:o-kam_client:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120336",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T16:03:32.874802Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T16:03:58.016Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:vstarcam:o-kam_client:*:*:*:*:*:*:*:*"
],
"product": "O-KAM Client",
"vendor": "VStarcam",
"versions": [
{
"status": "affected",
"version": "1.3.3.32"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in VStarcam O-KAM Client 1.3.3.32. Affected by this vulnerability is the function FUN_10003EA0 in the library DevDll_925.dll. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T03:15:18.679Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-429661 | VStarcam O-KAM Client DevDll_925.dll FUN_10003EA0 stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/429661"
},
{
"name": "VDB-429661 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/429661/cti"
},
{
"name": "CVE-2026-120336 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-120336"
},
{
"name": "Submit #1016301 | Shenzhen VStarcam Technology Co., Ltd O-KAM Client (DevDll_925.dll) 1.3.3.32 CWE-121: Stack-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1016301"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/Ishanoshada/f6345a42a46e1345e6c7400aac311d77"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-01T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-01T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-01T15:41:48.000Z",
"value": "VulDB entry last update"
}
],
"title": "VStarcam O-KAM Client DevDll_925.dll FUN_10003EA0 stack-based overflow",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-120336",
"datePublished": "2026-11-02T03:15:18.679Z",
"dateReserved": "2026-11-01T14:36:38.832Z",
"dateUpdated": "2026-11-05T16:03:58.016Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120283 (GCVE-0-2026-120283)
Vulnerability from cvelistv5 – Published: 2026-11-02 01:00 – Updated: 2026-11-02 14:24
VLAI
EPSS
VEX
Title
Linksys E8450 portal.cgi strcpy stack-based overflow
Summary
A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 14:23 UTC
Assigner
VulDB
CNA
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/429627 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/429627/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-120283 | third-party-advisory |
| https://vuldb.com/submit/1014924 | third-party-advisory |
| https://www.linksys.com/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120283",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T14:23:45.555931Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:24:28.643Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:linksys:e8450_firmware:*:*:*:*:*:*:*:*"
],
"product": "E8450",
"vendor": "Linksys",
"versions": [
{
"status": "affected",
"version": "1.2.00.360516"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fanchai (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T01:00:22.303Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-429627 | Linksys E8450 portal.cgi strcpy stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/429627"
},
{
"name": "VDB-429627 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/429627/cti"
},
{
"name": "CVE-2026-120283 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-120283"
},
{
"name": "Submit #1014924 | Linksys E8450 firmware 1.2.00.360516 Linksys E8450 portal.cgi hidden_timezone stack buffer overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1014924"
},
{
"tags": [
"product"
],
"url": "https://www.linksys.com/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-01T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-01T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-01T09:03:17.000Z",
"value": "VulDB entry last update"
}
],
"title": "Linksys E8450 portal.cgi strcpy stack-based overflow",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-120283",
"datePublished": "2026-11-02T01:00:22.303Z",
"dateReserved": "2026-11-01T07:58:12.074Z",
"dateUpdated": "2026-11-02T14:24:28.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120281 (GCVE-0-2026-120281)
Vulnerability from cvelistv5 – Published: 2026-11-02 00:30 – Updated: 2026-11-06 19:25
VLAI
EPSS
VEX
Title
WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow
Summary
A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:25 UTC
Assigner
VulDB
CNA
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/429625 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/429625/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-120281 | third-party-advisory |
| https://vuldb.com/submit/919790 | third-party-advisory |
| https://github.com/F-yyjy/cve/blob/main/WN536AX6-… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WAVLINK | WN536AX6-A |
Affected:
V260507
cpe:2.3:a:wavlink:wn536ax6-a:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120281",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:25:00.757045Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:25:24.620Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:wavlink:wn536ax6-a:*:*:*:*:*:*:*:*"
],
"modules": [
"OpenVPN Handler"
],
"product": "WN536AX6-A",
"vendor": "WAVLINK",
"versions": [
{
"status": "affected",
"version": "V260507"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "yyjy (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T00:30:18.106Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-429625 | WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/429625"
},
{
"name": "VDB-429625 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/429625/cti"
},
{
"name": "CVE-2026-120281 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-120281"
},
{
"name": "Submit #919790 | Wavlink WN536AX6 V260507 CWE-121",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/919790"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/F-yyjy/cve/blob/main/WN536AX6-A_openvpn_ip.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-01T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-01T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-01T14:27:42.000Z",
"value": "VulDB entry last update"
}
],
"title": "WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-120281",
"datePublished": "2026-11-02T00:30:18.106Z",
"dateReserved": "2026-11-01T07:44:16.932Z",
"dateUpdated": "2026-11-06T19:25:24.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-10
Operation
Build and Compilation
Strategy: Environment Hardening
- Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
- D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation
Implementation
Implement and perform bounds checking on input.
Mitigation
Implementation
Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.
Mitigation MIT-11
Operation
Build and Compilation
Strategy: Environment Hardening
- Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
- Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
- For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
No CAPEC attack patterns related to this CWE.