{"id":"CVE-2026-116504","kind":"vulnerability","aliases":["CVE-2026-116504"],"related":[],"title":"TOTOLINK A950RG router: cloud upgrade FileName allows remote command injection","description":"A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.","summary":"TOTOLINK A950RG firmware V4.1.2cu.5268_B20221104 builds a shell command ('rm -rf %s') from the FileName parameter of the cloud upgrade handler (CloudACMunualUpdate -> setCloudUpgradeFW in upgrade.so). A logged-in attacker can run commands as root on the router. A public write-up with request examples exists. No fixed firmware is known.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"A950RG firmware","fixed":[],"affected":"4.1.2cu.5268_B20221104","ecosystem":"vendor"}],"ecosystems":[],"tags":["a950rg","command-injection","embedded","firmware","infrastructure","router","self-hosted","totolink"],"not_affected_if":["management-not-internet-exposed","other-device-models","strong-admin-password"],"how_to_check":"- Router admin page > status/system info: firmware V4.1.2cu.5268_B20221104 on an A950RG is affected.\n- Check whether the web management interface (HTTP on the WAN side, remote management, port forwards to 192.168.x.1) is reachable from the internet; the exploit needs a valid session token, so also check for default or weak admin credentials.\n- Look for unexpected processes or files in the router web root if you suspect compromise.","fix":"unknown: no vendor advisory or fixed firmware found. Check totolink.net download page for A950RG for newer firmware. Until then: turn off remote/WAN management, change the admin password, restrict the admin UI to trusted LAN hosts, or replace the device if it is end of life.","status":"open","published_at":"2026-10-26T21:18:12+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","triaged_at":"2026-10-26T21:21:05+00:00","updated_at":"2026-10-26T21:21:44+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-26T21:21:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"TOTOLINK A950RG router: cloud upgrade FileName allows remote command injection","impact":"high","summary":"The TOTOLINK A950RG router firmware 4.1.2cu.5268_B20221104 passes the FileName argument of its cloud firmware upgrade function unsafely into a system command. A remote attacker can run arbitrary commands on the router, and a public exploit has been disclosed.","category":"infrastructure","nicknames":[],"who_cares":["totolink","router","embedded","firmware","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands on the router remotely","analyst_note":"Check the NVD entry and the vendor (TOTOLINK) site for a fixed firmware version and whether the cloud upgrade endpoint requires authentication.","how_to_check":"- Check the firmware version in the router admin interface or with the device's status page; affected build is `4.1.2cu.5268_B20221104`\n- Confirm whether the cloud upgrade feature (setCloudUpgradeFW in lib/cste_modules/upgrade.so) is reachable from the internet via port forwarding or exposed management access","needs_analyst":true,"not_affected_if":["other-device-models","management-not-internet-exposed"],"who_is_affected":"Owners and operators of TOTOLINK A950RG routers on the affected firmware are exposed, especially where the management interface is reachable from outside the local network. Teams that do not run this device model can skip it. The sources do not say whether a vendor fixed firmware exists.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000634,"input_tokens":3351,"output_tokens":598,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry and the vendor (TOTOLINK) site for a fixed firmware version and whether the cloud upgrade endpoint requires authentication.","search":"'-116504':13A,16A '-2026':12A,15A '4.1.2':90C 'a950rg':2A,17A,19B,32B,89C 'affect':93C 'allow':7A 'argument':110C 'attack':59B,117C 'build':35B 'cloud':4A,48B,104C 'cloudacmunualupd':51B 'command':9A,21B,38B,62B,114C 'command-inject':20B 'compon':103C 'cu.5268_b20221104':91C 'cve':11A,14A 'disclos':126C 'embed':23B 'exampl':75B 'exist':76B 'exploit':123C 'file':99C 'filenam':6A,44B,111C 'firmwar':24B,33B,79B 'firmware':18A 'fix':78B 'found':86C 'function':95C 'handler':50B 'host':29B 'infrastructur':25B 'initi':120C 'inject':10A,22B,115C 'known':81B 'lead':112C 'lib/cste_modules/upgrade.so':100C 'log':57B 'logged-in':56B 'manipul':107C 'may':131C 'paramet':45B 'public':69B,129C 'remot':8A,121C 'request':74B 'rf':40B 'rm':39B 'root':64B 'router':3A,26B,67B 'run':61B 'self':28B 'self-host':27B 'setcloudupgradefw':52B,96C 'shell':37B 'totolink':1A,30B,31B,88C 'upgrad':5A,49B,105C 'upgrade.so':54B 'use':133C 'v4.1.2cu.5268_b20221104':34B 'vulner':83C 'write':71B 'write-up':70B","nicknames":[],"mitigations":[],"who_affected":"Owners of TOTOLINK A950RG routers running firmware V4.1.2cu.5268_B20221104. The command injection needs a logged-in session, so it matters most where the admin interface is reachable from the internet or the admin password is default or weak, or for anyone on the LAN. Other TOTOLINK models and other firmware builds are not named; networks without this device can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-116504","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116504","severity":null,"published_at":"2026-10-26T21:18:12+00:00","modified_at":"2026-10-26T21:18:12+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","fetched_at":"2026-10-26T21:20:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116504:840","url":null,"severity":null,"published_at":"2026-10-26T21:21:44+00:00","modified_at":"2026-10-26T21:21:44+00:00","first_seen_at":"2026-10-26T21:21:44+00:00","fetched_at":"2026-10-26T21:21:44+00:00","note":"Researcher write-up (H3rmesk1t gist, 2026-10-10) read: sink is setCloudUpgradeFW reached via authenticated POST /cgi-bin/cstecgi.cgi topicurl setting/CloudACMunualUpdate, FileName injected into 'rm -rf %s', runs as root, blind/async. Needs a valid session token (researcher rates PR:L, 8.8 on v3.1; NVD/VulDB 9.9). No in-the-wild exploitation found. No vendor advisory or fixed firmware found; vendor download page lists no 4.1.2cu.5268 build. Nothing marked verified (no vendor text)."}],"documents":[{"id":4455,"url":"https://gist.github.com/H3rmesk1t/c2f2dcfdb6238a7ddb8fb0622ad52948","title":"TOTOLINK A950RG V4.1.2cu.5268_B20221104 - Command Injection in setCloudUpgradeFW (H3rmesk1t)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1431,"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/167/ids/36.html","title":"TOTOLINK A950RG download page","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}