---
id: "CVE-2026-114575"
kind: "vulnerability"
aliases: ["CVE-2026-114575"]
title: "TOTOLINK A950RG router: FileMd5 argument allows remote command injection"
severity: "critical"
cvss: 10.0
epss: 0.0221
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "A950RG firmware", "fixed": [], "affected": "4.1.2cu.5268_B20221104", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["a950rg", "command-injection", "infrastructure", "rce", "routers", "self-hosted", "totolink"]
not_affected_if: ["different-firmware-version", "management-interface-not-exposed"]
published_at: "2026-10-22T01:16:58+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-24T07:15:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114575", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:25:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:49:26+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114575", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# TOTOLINK A950RG router: FileMd5 argument allows remote command injection

The TOTOLINK A950RG router firmware has a command injection flaw in its UploadCustomModule function, reached through the FileMd5 argument. A remote attacker can run operating system commands on the router, and a public exploit has been published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:A950RG firmware affected 4.1.2cu.5268_B20221104 fixed ?

## How to check

Log in to the router admin page (default 192.168.1.1) and check the firmware version under Status or System. 4.1.2cu.5268_B20221104 is confirmed affected. Other 4.1.2cu builds are untested, so treat them as possibly affected. Check whether the admin interface is reachable from WAN or untrusted LAN segments.

## Fix

No patched firmware is known. Disable remote/WAN management, restrict admin access to a trusted host, and put the router behind another firewall. Replace the device if TOTOLINK ships no fix. Check totolink.net and totolink.tw for new A950RG firmware. VulDB says no authentication is needed.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114575
- 2026-10-23T22:25:13+00:00 analyst — No vendor advisory or patch found. VulDB (submitter H3rmesk1t) says no auth is needed and a PoC gist exists on gist.github.com (URL not shown, so not linked). No confirmed exploitation, not in KEV. TOTOLINK's A950RG download page lists no firmware newer than V4.1.2cu.5161_B20200903, and the Taiwan site mentions a 2023-12-15 release. Whether either one fixes this is unknown.
- 2026-10-23T22:49:26+00:00 analyst — Return visit: no new sources or documents since run 218. Restored the fix, how-to-check and auth details, which the triage rewrite had reduced to unknown. Still no vendor advisory or patched firmware found.
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114575

## Documents

- [advisory] VulDB VDB-424943: TOTOLINK A950RG UploadCustomModule FileMd5 command injection https://vuldb.com/vuln/424943
- [mentions] TOTOLINK A950RG download page https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/167/ids/36.html

## From the sources

A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_