TOTOLINK A950RG: Command injection in firewall.so apmib_set
Summary
TOTOLINK A950RG routers running firmware 4.1.2cu.5268_B20221104 contain a command injection flaw in the apmib_set function of firewall.so. According to VulDB, the CNA, a remote attacker can inject operating system commands, which may lead to full compromise of the device. The exploit has been publicly disclosed, and no vendor fix had been found at the time of research.
Affected
- TOTOLINK A950RG, firmware 4.1.2cu.5268_B20221104
- Other firmware builds: Unknown.
Fixed in
Unknown. No vendor advisory or fixed firmware found.
Workaround
- Disable remote WAN administration on the device.
- Restrict the management interface to the LAN.
- No vendor workaround confirmed.
Exploitation
- Publicly disclosed. VulDB lists the exploit status as Proof-of-Concept.
- Not listed as known exploited (CISA KEV: No, per Strix).
- Evidence of attacks in the wild: Unknown.
Our recommendation
- Check whether any A950RG with this firmware is reachable from the internet. If so, disable remote administration immediately.
- Isolate the device from critical systems and restrict management access to the LAN.
- Monitor TOTOLINK for an advisory and fixed firmware. Plan replacement if no fix is published.
- The CVSS rating is disputed (8.6 CVSS 4.0 here, 9.4 or 9.9 in other sources). Plan on the higher value.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB vulnerability entry vuldb.com
- OpenCVE entry app.opencve.io
- Strix CVE entry www.strix.ai
- The Hacker Wire advisory www.thehackerwire.com
- OffSeq Radar entry radar.offseq.com
- HOL Guard entry hol.org
- TOTOLINK website www.totolink.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:04.
Original description (NVD)
A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function apmib_set of the file firewall.so. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.