TOTOLINK A950RG: Command injection in device information handler
Summary
The device-information handler (getDeviceInfo) of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 builds shell commands from a MAC address value read from the DHCP lease file and persisted state without validation. An attacker who can get a crafted value into these files could execute commands as root on the router. A public proof of concept exists, no fixed firmware is known, and sources disagree on whether the attack is remote and whether it needs privileges.
Affected
- TOTOLINK A950RG, firmware 4.1.2cu.5268_B20221104 (only version listed in the sources found)
- Other firmware versions: Unknown.
Fixed in
- Unknown. No fixed firmware or vendor advisory was found.
Workaround
- No vendor mitigation found.
- Disable remote and WAN management.
- Do not expose the router admin interface to the internet.
- Limit admin access to trusted LAN addresses and place the device in a separate network segment.
- Change default admin credentials.
Exploitation
- Public proof of concept: yes (VulDB states the exploit is public and could be used).
- Known exploited in the wild: Unknown. Not listed as known exploited in the sources checked.
- CISA SSVC: Exploitation poc, Automatable no, Technical Impact total.
Our recommendation
- Find every A950RG in the environment and confirm the firmware version.
- Remove internet exposure of the admin interface and isolate the device in its own network segment.
- Review device logs for unexpected changes.
- Check the TOTOLINK download page for a newer firmware for your hardware revision; do not assume a patch exists.
- If no supported firmware becomes available, plan to replace the device.
- Verify exposure and privilege requirements in a lab, since the CVSS scores and CWE data differ between sources.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Exploit gist (H3rmesk1t) - Command injection write-up gist.github.com
- VulDB CVE-2026-116505 vuldb.com
- VulDB entry 426403 vuldb.com
- TOTOLINK website www.totolink.net
- Strix CVE-2026-116505 www.strix.ai
- hol.org CVE-2026-116505 hol.org
- threatint CVE-2026-116505 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:05.
Original description (NVD)
A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the file /var/lib/misc/udhcpd.leases of the component device-information Handler. The manipulation of the argument MAC address results in command injection. The attack can be launched remotely. The exploit has been made public and could be used.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.