{"id":"CVE-2026-116505","kind":"vulnerability","aliases":["CVE-2026-116505"],"related":[],"title":"TOTOLINK A950RG router: MAC address input enables remote command injection","description":"A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the file /var/lib/misc/udhcpd.leases of the component device-information Handler. The manipulation of the argument MAC address results in command injection. The attack can be launched remotely. The exploit has been made public and could be used.","summary":"A flaw in the device-information handler of the TOTOLINK A950RG router lets a crafted MAC address value inject operating system commands. A remote attacker can run commands on the router with no account needed according to the advisory's remote-launch description.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firmware","infrastructure","router","self-hosted","totolink"],"not_affected_if":["different-hardware","management-not-exposed"],"how_to_check":"- Check the firmware version on the router admin page or with the device label; the affected build is `4.1.2cu.5268_B20221104`\n- unknown","fix":"- Update the TOTOLINK A950RG firmware to a fixed release from the vendor (version unknown)\n- Until patched, restrict access to the router's management interface and disable remote administration\n- unknown","status":"open","published_at":"2026-10-26T21:18:12+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","triaged_at":"2026-10-26T21:21:05+00:00","updated_at":"2026-10-26T21:21:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T21:21:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update the TOTOLINK A950RG firmware to a fixed release from the vendor (version unknown)\n- Until patched, restrict access to the router's management interface and disable remote administration\n- unknown","reach":"internet","title":"TOTOLINK A950RG router: MAC address input enables remote command injection","impact":"high","summary":"A flaw in the device-information handler of the TOTOLINK A950RG router lets a crafted MAC address value inject operating system commands. A remote attacker can run commands on the router with no account needed according to the advisory's remote-launch description.","category":"infrastructure","nicknames":[],"who_cares":["totolink","router","firmware","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Commands run on the router, exposing the local network","analyst_note":"Check the NVD entry and TOTOLINK's vendor advisory for a fixed firmware version and whether authentication is required on the affected handler.","how_to_check":"- Check the firmware version on the router admin page or with the device label; the affected build is `4.1.2cu.5268_B20221104`\n- unknown","needs_analyst":true,"not_affected_if":["different-hardware","management-not-exposed"],"who_is_affected":"Owners of TOTOLINK A950RG routers on firmware `4.1.2cu.5268_B20221104` are exposed, especially where the management interface is reachable from untrusted networks. Teams that do not run this model, or that use a different router or vendor, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000613,"input_tokens":3340,"output_tokens":558,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-116505':13A,16A '-2026':12A,15A '/var/lib/misc/udhcpd.leases':86C '4.1.2':76C 'a950rg':2A,35B,75C 'accord':60B 'account':58B 'address':5A,41B,100C 'advisori':63B 'argument':98C 'attack':49B,106C 'command':9A,46B,52B,103C 'compon':89C 'could':118C 'craft':39B 'cu.5268_b20221104':77C 'cve':11A,14A 'descript':68B 'devic':29B,91C 'device-inform':28B,90C 'enabl':7A 'exploit':112C 'file':85C 'firmwar':17B 'flaw':25B 'found':72C 'function':81C 'getdeviceinfo':82C 'handler':31B,93C 'host':22B 'impact':79C 'inform':30B,92C 'infrastructur':18B 'inject':10A,43B,104C 'input':6A 'launch':67B,109C 'let':37B 'mac':4A,40B,99C 'made':115C 'manipul':95C 'need':59B 'oper':44B 'public':116C 'remot':8A,48B,66B,110C 'remote-launch':65B 'result':101C 'router':3A,19B,36B,55B 'run':51B 'self':21B 'self-host':20B 'system':45B 'totolink':1A,23B,34B,74C 'use':120C 'valu':42B 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Owners of TOTOLINK A950RG routers on firmware `4.1.2cu.5268_B20221104` are exposed, especially where the management interface is reachable from untrusted networks. Teams that do not run this model, or that use a different router or vendor, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116505","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116505","severity":null,"published_at":"2026-10-26T21:18:12+00:00","modified_at":"2026-10-26T21:18:12+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","fetched_at":"2026-10-26T21:20:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}