CVE-2026-116505
Received Received - Intake

Command Injection in TOTOLINK A950RG Router

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description
A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the file /var/lib/misc/udhcpd.leases of the component device-information Handler. The manipulation of the argument MAC address results in command injection. The attack can be launched remotely. The exploit has been made public and could be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-27
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116505
EUVD
EUVD-2026-110448

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
TOTOLINK A950RG 4.1.2cu.5268_B20221104

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a command injection flaw in TOTOLINK A950RG firmware version 4.1.2cu.5268_B20221104. It exists in the getDeviceInfo function of the device-information handler component, specifically in the file /var/lib/misc/udhcpd.leases. The issue allows an attacker to inject malicious commands by manipulating the MAC address parameter, which is processed without proper input validation.

Detection Guidance

Check if your network has TOTOLINK A950RG devices running firmware version 4.1.2cu.5268_B20221104. Inspect the file /var/lib/misc/udhcpd.leases for suspicious MAC address entries. Monitor network traffic for unexpected command execution attempts.

Impact Analysis

This vulnerability can be exploited remotely to execute arbitrary commands on the affected device. This could lead to full system compromise, unauthorized access, data theft, or disruption of network services. Attackers could gain control over the router, monitor traffic, or use it as a pivot point for further attacks within the network.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A successful exploit could result in data breaches, triggering regulatory penalties and legal consequences.

Mitigation Strategies

Isolate affected devices from the network. Apply vendor patches if available. Disable remote access to the device interface. Monitor for unusual activity. Consider replacing the device if no patch is provided.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116505. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart