CVE-2026-114575 Details

A command injection vulnerability has been identified in the TOTOLINK A950RG router, specifically in the firmware version 4.1.2cu.5268_B20221104. The issue arises in the UploadCustomModule function within the file lib/cste_modules/product.so. This vulnerability allows for unauthenticated remote code execution by exploiting the handling of the FileMd5 argument. The flaw exists because the function lacks proper validation and integrity checks, enabling attackers to upload malicious shared objects that are executed with root privileges.

To address this vulnerability, it is recommended to authenticate the upload process and remove the UploadCustomModule handler from the authentication whitelist. The integrity check should be revised to verify a vendor signature over the uploaded object, and the module loader should only accept objects from the vendor's read-only directory. Additionally, the parameter handling should enforce size limits to prevent buffer overflows.