Live › vulnerability › CVE-2026-116504
Go to dashboardTOTOLINK A950RG firmware V4.1.2cu.5268_B20221104 builds a shell command ('rm -rf %s') from the FileName parameter of the cloud upgrade handler (CloudACMunualUpdate -> setCloudUpgradeFW in upgrade.so). A logged-in attacker can run commands as root on the router. A public write-up with request examples exists. No fixed firmware is known.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Owners of TOTOLINK A950RG routers running firmware V4.1.2cu.5268_B20221104. The command injection needs a logged-in session, so it matters most where the admin interface is reachable from the internet or the admin password is default or weak, or for anyone on the LAN. Other TOTOLINK models and other firmware builds are not named; networks without this device can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| A950RG firmware | vendor | 4.1.2cu.5268_B20221104 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
This page as .md · .json · in your agent: get_signal("CVE-2026-116504")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.