CVE-2026-116506 Details

A command injection vulnerability has been identified in the TOTOLINK A950RG router, specifically in the firmware version 4.1.2cu.5268_B20221104. The issue arises in the function 'apmib_set' within the file 'firewall.so', where the web interface can store unvalidated configuration values that are later executed as shell commands by a separate program called 'bin/sysconf'. This vulnerability can be exploited remotely, with the injected commands being executed with root privileges.

To address this vulnerability, the 'bin/sysconf' program should be modified to handle configuration values safely, avoiding shell command interpolation. Instead, values should be processed using argument vectors or direct system calls. Additionally, all web handlers must implement proper validation of input before storing it in the MIB, treating MIB values as untrusted data. Finally, the configuration restoration process should be secured by authenticating and validating values from attacker-supplied images.