TOTOLINK A950RG: Command injection in cloud firmware upgrade
Summary
The cloud firmware upgrade function (setCloudUpgradeFW in lib/cste_modules/upgrade.so) of the TOTOLINK A950RG router does not properly neutralize the FileName parameter. A remote attacker can inject operating system commands, which run as root on the device. Per the CVE record the CVSS v4.0 base score is 8.6 (High). Public proof-of-concept code exists. Whether the vulnerable path can be reached without authentication is unverified.
Affected
- TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104
- Other firmware builds: unknown
Fixed in
Unknown. No vendor advisory or patched firmware was found.
Workaround
- No vendor-confirmed workaround is available.
- Disable remote management and remove WAN exposure of the management interface.
- Restrict administrative access to a management VLAN or specific IP addresses.
Exploitation
- Public proof-of-concept exploit available (VulDB: Proof-of-Concept).
- No in-the-wild exploitation recorded in the sources reviewed.
- Not listed as known exploited in the sources reviewed; CISA KEV was not checked directly.
Our recommendation
- Confirm the firmware build on every A950RG device.
- Remove internet exposure of the management interface now and disable remote management.
- Restrict administrative access to trusted hosts only.
- Monitor the router for unexpected outbound connections.
- Check TOTOLINK for a fixed firmware. If none is published, plan replacement with a supported model.
- Check related CVE-2026-116505 and CVE-2026-116506 together with this entry.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-116504 VulDB vuldb.com
- VulDB vulnerability 426402 vuldb.com
- Exploit gist (H3rmesk1t) gist.github.com
- OffSeq Radar CVE-2026-116504 radar.offseq.com
- HOL Guard CVE-2026-116504 hol.org
- Strix CVE-2026-116504 www.strix.ai
- OpenCVE CVE-2026-116504 app.opencve.io
- TOTOLINK website www.totolink.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:04.
Original description (NVD)
A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.