CVE-2026-116504
CriticalCVSS 9.9Summary
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the setCloudUpgradeFW function in lib/cste_modules/upgrade.so is vulnerable to command injection via manipulation of the FileName argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker can execute arbitrary commands on the device, potentially taking control of the router. The public availability of the exploit increases the risk of exploitation.
Recommendation
Update the TOTOLINK A950RG firmware to a patched version or restrict access to the management interface. Until patched, consider disabling remote management and monitoring for unusual activity.
Other vulnerabilities in TOTOLINK A950RG
See all- CVE-2026-116508Critical
TOTOLINK A950RG 4.1.2cu.5268_B20221104 contains a stack-based buffer overflow in function sub_402340 of infostat.cgi (Device-Information CGI component). Manipulating the CONTENT_LENGTH argument causes overflow, and the exploit is publicly available.
- CVE-2026-116506Critical
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the apmib_set function in firewall.so is vulnerable to command injection. The vulnerability can be exploited remotely, and a public exploit is available.
- CVE-2026-116505Critical
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the getDeviceInfo function in /var/lib/misc/udhcpd.leases is vulnerable to command injection via manipulation of the MAC address argument. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-114575Critical
In TOTOLINK A950RG 4.1.2cu.5268_B20221104, the UploadCustomModule function in lib/cste_modules/product.so is vulnerable to command injection via manipulation of the FileMd5 argument. The attack can be launched remotely, and the exploit has been published and may be used.
Original NVD description (English source)
A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS