CVE-2026-116504 is a critical (CVSS 3.1: 9.9) remote command injection flaw in the Cloud Upgrade component of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104, and a public exploit has already been disclosed.
What Is It
The flaw is in the setCloudUpgradeFW function in lib/cste_modules/upgrade.so, which is part of the router's Cloud Upgrade component. Manipulating the FileName argument lets an attacker inject commands. The CNA (VulDB) classifies it under CWE-74 (Injection) and CWE-77 (Command Injection).
The record says the attack can be launched remotely. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) describes a network-reachable, low-complexity attack. It needs low privileges and no user interaction, and it has a changed scope.
Why It Matters
- Severity: CVSS 3.1 base score 9.9 (CRITICAL). CVSS 4.0 rates it 8.6 (HIGH) and CVSS 2.0 rates it 9.0.
- Impact: High impact to confidentiality, integrity and availability. CVSS 4.0 also rates the impact on subsequent systems as High in all three areas, so a compromised router could be used to reach other systems.
- Exploit availability: The NVD description says the exploit "has been disclosed to the public and may be used." The CVSS 4.0 exploit maturity is Proof-of-Concept, and a public write-up is linked in the references.
- KEV status: As of this writing, CVE-2026-116504 does not appear in the CISA Known Exploited Vulnerabilities catalog. CISA has not confirmed active exploitation in the wild.
A public PoC is available, and the CVSS vector rates the attack as low-complexity, network-reachable and requiring only low privileges. Together these suggest the barrier to exploitation is likely low. However, real-world difficulty will depend on whether attackers can reach the management interface and obtain the required credentials.
What's Vulnerable
| Vendor | Product | Component | Affected Version |
|---|---|---|---|
| TOTOLINK | A950RG | Cloud Upgrade | 4.1.2cu.5268_B20221104 |
The CNA-supplied CPE is cpe:2.3:o:totolink:a950rg_firmware:*:*:*:*:*:*:*:*. NVD lists the record as "Received," which means NVD has not finished its analysis yet.
Patch Status
The supplied sources don't mention a vendor patch, fixed firmware version or official advisory. There is no CISA KEV entry, so no federal remediation deadline or required action applies.
Until TOTOLINK says more, A950RG owners should check the vendor site for firmware updates. They should also limit network access to the device's management interface where they can. Treat devices running the affected build as exposed while a public exploit is available.