---
id: "CVE-2026-116504"
kind: "vulnerability"
aliases: ["CVE-2026-116504"]
title: "TOTOLINK A950RG router: cloud upgrade FileName allows remote command injection"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "A950RG firmware", "fixed": [], "affected": "4.1.2cu.5268_B20221104", "ecosystem": "vendor"}]
ecosystems: []
tags: ["a950rg", "command-injection", "embedded", "firmware", "infrastructure", "router", "self-hosted", "totolink"]
not_affected_if: ["management-not-internet-exposed", "other-device-models", "strong-admin-password"]
published_at: "2026-10-26T21:18:12+00:00"
first_seen_at: "2026-10-26T21:20:31+00:00"
updated_at: "2026-10-26T21:21:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116504", "first_seen_at": "2026-10-26T21:20:31+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-26T21:21:44+00:00"}]
---

# TOTOLINK A950RG router: cloud upgrade FileName allows remote command injection

TOTOLINK A950RG firmware V4.1.2cu.5268_B20221104 builds a shell command ('rm -rf %s') from the FileName parameter of the cloud upgrade handler (CloudACMunualUpdate -> setCloudUpgradeFW in upgrade.so). A logged-in attacker can run commands as root on the router. A public write-up with request examples exists. No fixed firmware is known.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:A950RG firmware affected 4.1.2cu.5268_B20221104 fixed ?

## How to check

- Router admin page > status/system info: firmware V4.1.2cu.5268_B20221104 on an A950RG is affected.
- Check whether the web management interface (HTTP on the WAN side, remote management, port forwards to 192.168.x.1) is reachable from the internet; the exploit needs a valid session token, so also check for default or weak admin credentials.
- Look for unexpected processes or files in the router web root if you suspect compromise.

## Fix

unknown: no vendor advisory or fixed firmware found. Check totolink.net download page for A950RG for newer firmware. Until then: turn off remote/WAN management, change the admin password, restrict the admin UI to trusted LAN hosts, or replace the device if it is end of life.

## Timeline

- 2026-10-26T21:20:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116504
- 2026-10-26T21:21:44+00:00 analyst — Researcher write-up (H3rmesk1t gist, 2026-10-10) read: sink is setCloudUpgradeFW reached via authenticated POST /cgi-bin/cstecgi.cgi topicurl setting/CloudACMunualUpdate, FileName injected into 'rm -rf %s', runs as root, blind/async. Needs a valid session token (researcher rates PR:L, 8.8 on v3.1; NVD/VulDB 9.9). No in-the-wild exploitation found. No vendor advisory or fixed firmware found; vendor download page lists no 4.1.2cu.5268 build. Nothing marked verified (no vendor text).

## Documents

- [mentions] TOTOLINK A950RG download page https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/167/ids/36.html
- [poc] TOTOLINK A950RG V4.1.2cu.5268_B20221104 - Command Injection in setCloudUpgradeFW (H3rmesk1t) https://gist.github.com/H3rmesk1t/c2f2dcfdb6238a7ddb8fb0622ad52948

## From the sources

A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_