CVE-2026-114575

TOTOLINK A950RG product.so UploadCustomModule command injection

State: Published
Severity: 10.0 Critical
Published: Oct 22, 2026
Updated: Oct 28, 2026
Reserved: Oct 21, 2026

Description

A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.

Scores

CVSS	Score	Vector	Source
4.0	10.0 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P	VulDB
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
3.0	10.0 Critical	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
2.0	10.0 High	AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-77 Command Injection
CWE-74 Injection

Affected Products

Product	Versions
A950RGTOTOLINK	4.1.2cu.5268_B20221104Affected

References

VDB-424943 | TOTOLINK A950RG product.so UploadCustomModule command injectionvdb-entrytechnical-description
VDB-424943 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-114575 | CVE Analysis and Reportthird-party-advisory
Submit #1021292 | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Command Injectionthird-party-advisory
https://gist.github.com/H3rmesk1t/3a629799af33425e07571182e539a794exploit
https://www.totolink.net/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.