CVE-2026-114575

TOTOLINK A950RG product.so UploadCustomModule command injection

View on CVE.org
Published Oct 22, 2026 CVSS 4.0 · 10 Critical EPSS 2.2% KEV · Not listed
Description
A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.

Analysis

AI-generated

Technical impact

The vulnerability lies in the UploadCustomModule function within lib/cste_modules/product.so of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104. By manipulating the FileMd5 parameter, an attacker can inject arbitrary shell commands, leading to remote code execution. This flaw is a command injection weakness (CWE-77) resulting from unsanitized input handling (CWE-74).

Affected Systems

Affected systems are TOTOLINK A950RG devices running firmware version 4.1.2cu.5268_B20221104. The vulnerability exists in the UploadCustomModule function of lib/cste_modules/product.so. Based on the description, it is inferred that the command can be accessed remotely, possibly through a management endpoint, but the specific remote interface is not explicitly detailed in the information given.

Risk and Exploitability

The CVSS score of 10 reflects maximum severity and indicates that an attacker can gain full control of the device. An exploit has already been published on public repositories, demonstrating the vulnerability’s practicality. The EPSS score is 2%, which suggests a low but non‑zero probability of exploitation; when combined with the confirmed exploitation and remote launch nature it still elevates the risk. The vulnerability is not yet listed in the CISA KEV catalog; however, its confirmed exploitation and remote command injection capability warrant immediate attention.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor’s latest firmware update that includes the fix for the command injection vulnerability
  • If a firmware update is not yet available, temporarily block or restrict the UploadCustomModule endpoint to trusted IP addresses only
  • Isolate the device from untrusted networks and enforce strict firewall rules to limit remote management traffic

Generated by OpenCVE AI on October 22, 2026 at 15:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Totolink a950rg
Vendors & Products Totolink a950rg
Type Values Removed Values Added
Description A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.
Title TOTOLINK A950RG product.so UploadCustomModule command injection
First Time appeared Totolink
Totolink a950rg Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:totolink:a950rg_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a950rg Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 28, 2026, 6:42 PM
Reserved
Oct 21, 2026, 6:18 PM

View source JSON

Updated
Oct 28, 2026, 6:38 PM

JSON

Status
Deferred
Published
Oct 22, 2026, 1:16 AM
Modified
Oct 28, 2026, 7:17 PM

View source JSON

No data.

Updated
Oct 22, 2026, 3:15 PM

JSON