CVE-2026-116506 is a critical command injection flaw in the apmib_set function of TOTOLINK A950RG router firmware. It can be triggered remotely, and a public exploit has been disclosed.
What Is It
The flaw is in the apmib_set function of the firewall.so file in TOTOLINK A950RG firmware version 4.1.2cu.5268_B20221104. Manipulating this function causes command injection. The CNA (VulDB) classifies the weakness as CWE-74 (Injection) and CWE-77 (Command Injection).
The CVE was published on 2026-10-26. Its NVD status is currently "Received," which means NVD has not yet completed its own analysis.
Why It Matters
VulDB rates the flaw CVSS 3.1 9.9 (CRITICAL) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That means:
- Remote: the attack works over the network.
- Easy to exploit: attack complexity is low, and only low privileges are needed.
- No user interaction: nobody has to click or do anything.
- Wide impact: the scope is changed, and the impact on confidentiality, integrity and availability is high in all three cases.
The CVSS 4.0 score is 8.6 (HIGH), with exploit maturity marked as Proof-of-Concept. The CVSS 2.0 score is 9.0.
The description says the exploit "has been publicly disclosed and may be utilized." A public write-up is listed in the references. With exploit details public, attackers may find it easier to target exposed devices.
KEV status: CVE-2026-116506 is not in the CISA Known Exploited Vulnerabilities catalog. The supplied data does not confirm active exploitation in the wild.
What's Vulnerable
- Vendor: TOTOLINK
- Product: A950RG
- Affected version: 4.1.2cu.5268_B20221104
- CPE:
cpe:2.3:o:totolink:a950rg_firmware:*:*:*:*:*:*:*:* - Component:
firewall.so, functionapmib_set
Patch Status
The supplied records do not mention a vendor patch, a fixed firmware version or an advisory. Because the CVE is not in KEV, CISA has not issued a required action or due date.
Until TOTOLINK publishes fixed firmware, owners of affected A950RG devices should check the vendor site for updates. Because the attack works remotely, they should also check whether the device's management interfaces can be reached over the network.