What’s Vulnerable › Vulnerabilities
CVE-2026-116504: TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection
- Severity: critical (CVSS 9.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-26 · updated 2026-10-27
- Weakness: CWE-74
Description
A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Summary
A command injection flaw exists in the Cloud Upgrade component of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104, where manipulation of the FileName argument in setCloudUpgradeFW (lib/cste_modules/upgrade.so) allows arbitrary command execution. The vulnerability is remotely exploitable and rated critical (CVSS 9.9), potentially allowing an attacker to take full control of the device. A public exploit has been disclosed and may be used in attacks, though the issue is not listed in CISA KEV. Users should update to a fixed firmware version from TOTOLINK if available, and in the meantime restrict remote access to the device's management interface and isolate affected devices on the network.
توجد ثغرة حقن أوامر في مكوّن Cloud Upgrade في البرنامج الثابت TOTOLINK A950RG الإصدار 4.1.2cu.5268_B20221104، حيث يؤدي التلاعب بالوسيط FileName في الدالة setCloudUpgradeFW ضمن lib/cste_modules/upgrade.so إلى تنفيذ أوامر عشوائية. الثغرة قابلة للاستغلال عن بُعد وتصنَّف حرجة (CVSS 9.9)، وقد تتيح للمهاجم السيطرة الكاملة على الجهاز. تم الكشف عن استغلال علني وقد يُستخدم في الهجمات، لكن الثغرة غير مدرجة في CISA KEV. يُنصح المستخدمون بالترقية إلى إصدار برنامج ثابت من TOTOLINK إن توفّر، وبحين ذلك تقييد الوصول البعيد إلى واجهة إدارة الجهاز وعزل الأجهزة المتأثرة على الشبكة.
Affected products
- TOTOLINK A950RG: 4.1.2cu.5268_B20221104
References
- https://gist.github.com/H3rmesk1t/c2f2dcfdb6238a7ddb8fb0622ad52948
- https://vuldb.com/cve/CVE-2026-116504
- https://vuldb.com/submit/1022553
- https://vuldb.com/vuln/426402
- https://vuldb.com/vuln/426402/cti
- https://www.totolink.net/
Get alerted when CVE-2026-116504 or the next vulnerability affects your stack