Live › vulnerability › CVE-2026-116505
Go to dashboardA flaw in the device-information handler of the TOTOLINK A950RG router lets a crafted MAC address value inject operating system commands. A remote attacker can run commands on the router with no account needed according to the advisory's remote-launch description.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Owners of TOTOLINK A950RG routers on firmware are exposed, especially where the management interface is reachable from untrusted networks. Teams that do not run this model, or that use a different router or vendor, can skip it.
4.1.2cu.5268_B20221104No product ranges from the sources yet.
4.1.2cu.5268_B20221104Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the file /var/lib/misc/udhcpd.leases of the component device-information Handler. The manipulation of the argument MAC address results in command injection. The attack can be launched remotely. The exploit has been made public and could be used.
This page as .md · .json · in your agent: get_signal("CVE-2026-116505")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.