Live › vulnerability › CVE-2026-114575
Go to dashboardThe TOTOLINK A950RG router firmware has a command injection flaw in its UploadCustomModule function, reached through the FileMd5 argument. A remote attacker can run operating system commands on the router, and a public exploit has been published.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| A950RG firmware | vendor | 4.1.2cu.5268_B20221104 | – |
192.168.1.1) and check the firmware version under Status or System. 4.1.2cu.5268_B20221104 is confirmed affectedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.
This page as .md · .json · in your agent: get_signal("CVE-2026-114575")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.