CVE-2026-116504

TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection

State: Published
Severity: 9.4 Critical
Published: Oct 26, 2026
Updated: Oct 27, 2026
Reserved: Oct 26, 2026

Description

A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Scores

CVSS	Score	Vector	Source
4.0	9.4 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P	VulDB
3.1	9.9 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
3.0	9.9 Critical	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
2.0	9.0 High	AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-77 Command Injection
CWE-74 Injection

Affected Products

Product	Versions
A950RGTOTOLINK	4.1.2cu.5268_B20221104Affected

References

VDB-426402 | TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injectionvdb-entrytechnical-description
VDB-426402 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-116504 | CVE Analysis and Reportthird-party-advisory
Submit #1022553 | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Command Injectionthird-party-advisory
https://gist.github.com/H3rmesk1t/c2f2dcfdb6238a7ddb8fb0622ad52948exploit
https://www.totolink.net/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.