Command Injection in TOTOLINK A950RG Router

Executive Summary

CVE-2026-114575 is a critical command injection vulnerability in TOTOLINK A950RG router firmware version 4.1.2cu.5268_B20221104. The flaw exists in the UploadCustomModule function of lib/cste_modules/product.so, which fails to properly validate the FileMd5 parameter. Attackers can exploit this by sending a crafted HTTP POST request to remotely execute arbitrary commands on the device with root privileges.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized file uploads to the vulnerable endpoint, particularly MIPS32 shared object files. Monitor network traffic for HTTP POST requests targeting the UploadCustomModule function. Inspect logs for suspicious parameter manipulations like FileMd5 or FileUrl.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated remote attackers to gain full control of the affected TOTOLINK A950RG router. Attackers could intercept network traffic, steal sensitive data, install malware, or use the device as a pivot point to attack other systems on the network. Since the exploit executes with root privileges, the entire device is compromised.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates multiple compliance requirements including GDPR (data protection), HIPAA (health information security), and other privacy regulations. Compromised routers could lead to unauthorized access to personal data, violating confidentiality requirements. Organizations using affected devices would need to report breaches and implement compensating controls.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the UploadCustomModule function if possible. Implement strict input validation for FileMd5 and FileUrl parameters. Enforce authentication for all file upload endpoints. Restrict file uploads to secure directories and verify vendor signatures before execution.

Useful 0 Not Useful 0