A security flaw has been discovered in Totolink A3600R 5.9c.4959. This issue affects the function setAppEasyWizardConfig in the library /lib/cste_modules/app.so. Performing a manipulation of the argument apcliSsid results in buffer overflow. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
References
| Link | Resource |
|---|---|
| https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3600R/4959-apcliSsid-setAppEasyWizardConfig.md | Exploit Third Party Advisory |
| https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3600R/4959-apcliSsid-setAppEasyWizardConfig.md#poc | Exploit |
| https://vuldb.com/?ctiid.343480 | Permissions Required VDB Entry |
| https://vuldb.com/?id.343480 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.740888 | Third Party Advisory VDB Entry |
| https://www.totolink.net/ | Product |
Configurations
Configuration 1 (hide)
| AND |
|
History
10 Feb 2026, 14:43
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:totolink:a3600r_firmware:5.9c.4959:*:*:*:*:*:*:* cpe:2.3:h:totolink:a3600r:-:*:*:*:*:*:*:* |
|
| References | () https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3600R/4959-apcliSsid-setAppEasyWizardConfig.md - Exploit, Third Party Advisory | |
| References | () https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3600R/4959-apcliSsid-setAppEasyWizardConfig.md#poc - Exploit | |
| References | () https://vuldb.com/?ctiid.343480 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.343480 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.740888 - Third Party Advisory, VDB Entry | |
| References | () https://www.totolink.net/ - Product | |
| First Time |
Totolink
Totolink a3600r Firmware Totolink a3600r |
30 Jan 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-30 16:16
Updated : 2026-02-10 14:43
NVD link : CVE-2026-1686
Mitre link : CVE-2026-1686
CVE.ORG link : CVE-2026-1686
JSON object : View
Products Affected
totolink
- a3600r
- a3600r_firmware