CVE-2026-116504

Received Received - Intake

Command Injection in TOTOLINK A950RG Router

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description

A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-26

Last Modified

2026-10-26

Generated

2026-10-27

AI Q&A

2026-10-27

EPSS Evaluated

N/A

NVD

CVE-2026-116504

EUVD

EUVD-2026-110321

Affected Vendors & Products

Vendor	Product	Version / Range
TOTOLINK	A950RG	4.1.2cu.5268_B20221104

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is a command injection flaw in the TOTOLINK A950RG router version 4.1.2cu.5268_B20221104. It exists in the setCloudUpgradeFW function of the lib/cste_modules/upgrade.so component, specifically in the Cloud Upgrade feature. An attacker can remotely exploit this by manipulating the FileName argument to inject and execute arbitrary commands on the device.

Detection Guidance

Detecting this vulnerability requires checking for the presence of TOTOLINK A950RG devices running firmware version 4.1.2cu.5268_B20221104. Scan your network for devices with this model and firmware version. Check if the device exposes the vulnerable function setCloudUpgradeFW in lib/cste_modules/upgrade.so. Look for unusual network traffic or commands involving file uploads or system commands.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary commands on your router. This could lead to full system compromise, unauthorized access to your network, data theft, or turning the device into a botnet member. As a router, it may also expose other connected devices to attacks.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and security. Organizations using this device may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately disconnect the TOTOLINK A950RG device from the internet or any untrusted networks. Disable the Cloud Upgrade feature if possible. Update the device to the latest firmware version if a patch is available. Monitor network traffic for suspicious activity related to file uploads or command execution. Consider replacing the device if no patch is released.

Hi! I’m here to help you understand CVE-2026-116504. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70