{"id":"CVE-2026-114575","kind":"vulnerability","aliases":["CVE-2026-114575"],"related":[],"title":"TOTOLINK A950RG router: FileMd5 argument allows remote command injection","description":"A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.","summary":"The TOTOLINK A950RG router firmware has a command injection flaw in its UploadCustomModule function, reached through the FileMd5 argument. A remote attacker can run operating system commands on the router, and a public exploit has been published.","severity":"critical","cvss":10.0,"epss":0.0221,"exploited":false,"exploited_at":null,"products":[{"name":"A950RG firmware","fixed":[],"affected":"4.1.2cu.5268_B20221104","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["a950rg","command-injection","infrastructure","rce","routers","self-hosted","totolink"],"not_affected_if":["different-firmware-version","management-interface-not-exposed"],"how_to_check":"Log in to the router admin page (default 192.168.1.1) and check the firmware version under Status or System. 4.1.2cu.5268_B20221104 is confirmed affected. Other 4.1.2cu builds are untested, so treat them as possibly affected. Check whether the admin interface is reachable from WAN or untrusted LAN segments.","fix":"No patched firmware is known. Disable remote/WAN management, restrict admin access to a trusted host, and put the router behind another firewall. Replace the device if TOTOLINK ships no fix. Check totolink.net and totolink.tw for new A950RG firmware. VulDB says no authentication is needed.","status":"open","published_at":"2026-10-22T01:16:58+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:32:39+00:00","updated_at":"2026-10-24T07:15:52+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T22:32:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown: no fixed firmware version is named in the sources. Contact TOTOLINK for an update, and restrict or disable remote access to the router admin interface in the meantime.","reach":"internet","title":"TOTOLINK A950RG router: FileMd5 argument allows remote command injection","impact":"high","summary":"The TOTOLINK A950RG router firmware has a command injection flaw in its UploadCustomModule function, reached through the FileMd5 argument. A remote attacker can run operating system commands on the router, and a public exploit has been published.","category":"infrastructure","who_cares":["totolink","a950rg","routers","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs commands as root on the router remotely","analyst_note":"Confirm whether a fixed firmware version exists and whether authentication is required for UploadCustomModule, via https://nvd.nist.gov/vuln/detail/CVE-2026-114575 and TOTOLINK's vendor advisories.","how_to_check":"Check the router firmware version under the admin web interface or with the device label; affected version is 4.1.2cu.5268_B20221104. Whether the management interface is reachable from the internet: unknown","needs_analyst":true,"not_affected_if":["different-firmware-version","management-interface-not-exposed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00055,"input_tokens":2995,"output_tokens":500,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether a fixed firmware version exists and whether authentication is required for UploadCustomModule, via https://nvd.nist.gov/vuln/detail/CVE-2026-114575 and TOTOLINK's vendor advisories.","search":"'-114575':12A,15A '-2026':11A,14A '4.1.2':74C 'a950rg':2A,16A,18B,31B,73C 'affect':76C 'allow':6A 'argument':5A,47B,93C 'attack':50B,101C 'command':8A,20B,36B,55B,98C 'command-inject':19B 'cu.5268_b20221104':75C 'cve':10A,13A 'execut':88C 'exploit':62B,107C 'file':86C 'filemd5':4A,46B,94C 'firmwar':33B 'firmware':17A 'flaw':38B,67C 'found':70C 'function':42B,82C 'host':27B 'infrastructur':22B 'inject':9A,21B,37B,99C 'issu':79C 'launch':104C 'lead':96C 'lib/cste_modules/product.so':87C 'manipul':90C 'may':112C 'oper':53B 'public':61B 'publish':65B,110C 'rce':23B 'reach':43B 'remot':7A,49B,105C 'router':3A,24B,32B,58B 'run':52B 'self':26B 'self-host':25B 'system':54B 'totolink':1A,28B,30B,72C 'uploadcustommodul':41B,83C 'use':114C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T01:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114575","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114575","severity":null,"published_at":"2026-10-22T01:16:58+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114575:218","url":null,"severity":null,"published_at":"2026-10-23T22:25:13+00:00","modified_at":"2026-10-23T22:25:13+00:00","first_seen_at":"2026-10-23T22:25:13+00:00","fetched_at":"2026-10-23T22:25:13+00:00","note":"No vendor advisory or patch found. VulDB (submitter H3rmesk1t) says no auth is needed and a PoC gist exists on gist.github.com (URL not shown, so not linked). No confirmed exploitation, not in KEV. TOTOLINK's A950RG download page lists no firmware newer than V4.1.2cu.5161_B20200903, and the Taiwan site mentions a 2023-12-15 release. Whether either one fixes this is unknown."},{"source":"analyst","external_id":"CVE-2026-114575:306","url":null,"severity":null,"published_at":"2026-10-23T22:49:26+00:00","modified_at":"2026-10-23T22:49:26+00:00","first_seen_at":"2026-10-23T22:49:26+00:00","fetched_at":"2026-10-23T22:49:26+00:00","note":"Return visit: no new sources or documents since run 218. Restored the fix, how-to-check and auth details, which the triage rewrite had reduced to unknown. Still no vendor advisory or patched firmware found."},{"source":"epss","external_id":"CVE-2026-114575","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114575","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1430,"url":"https://vuldb.com/vuln/424943","title":"VulDB VDB-424943: TOTOLINK A950RG UploadCustomModule FileMd5 command injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1431,"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/167/ids/36.html","title":"TOTOLINK A950RG download page","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}