CVE-2026-116504 Details
Description
A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
A command injection vulnerability has been identified in the TOTOLINK A950RG router, specifically in the cloud upgrade functionality of the firmware version 4.1.2cu.5268_B20221104. The issue arises in the 'setCloudUpgradeFW' function within the 'lib/cste_modules/upgrade.so' file. The vulnerability allows remote attackers to inject commands by manipulating the 'FileName' parameter, which is then executed with root privileges. This exploitation can be achieved through the device's management interface or by compromising the cloud update process.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/H3rmesk1t/c2f2dcfdb6238a7ddb8fb0622ad52948 | [email protected] | ExploitRemedyTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-116504 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1022553 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/426402 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/426402/cti | [email protected] | Content Wall |
| https://www.totolink.net/ | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TOTOLINK A950RG | V4.1.2cu.5268_B20221104 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 27, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |