A critical command injection flaw in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 can be triggered remotely, and an exploit for it has been publicly released.
What Is It
CVE-2026-114575 is a command injection vulnerability in the TOTOLINK A950RG router. It is in the UploadCustomModule function of lib/cste_modules/product.so. An attacker can trigger command injection by manipulating the FileMd5 argument. VulDB, the reporting CNA, says the attack can be launched remotely.
The flaw is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command) and CWE-74 (Injection).
Why It Matters
VulDB scores this flaw at the top of the severity range:
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL, with exploit maturity marked as Proof-of-Concept
- CVSS 2.0: 10.0
The vectors describe an attack that works over the network and is easy to carry out. It needs no privileges and no user interaction, and it has high impact on confidentiality, integrity and availability. According to the record, the exploit "has been published and may be used," and a third-party write-up is linked in the references.
No CISA KEV entry was supplied for this CVE, so KEV does not confirm active exploitation in the wild at this time. Even so, a public proof-of-concept makes the flaw easier for attackers to exploit.
What's Vulnerable
- Vendor: TOTOLINK
- Product: A950RG
- Affected version: 4.1.2cu.5268_B20221104
- CPE:
cpe:2.3:o:totolink:a950rg_firmware:*:*:*:*:*:*:*:*
The supplied data does not identify any other affected firmware versions.
Patch Status
The supplied source material does not list a vendor patch, fixed firmware version or advisory. Because there is no KEV entry, CISA has not set a required action or due date. The NVD record is in "Received" status and has not yet been analyzed by NVD.
Owners of affected devices should check TOTOLINK's site for firmware updates and track the VulDB entries for changes.