CVE-2026-114575
A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104
- Risk score
- 82/100
- CVSS
- 10.0 v3.1
- Exploit chance (30 days)
- 2.2%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A critical flaw in TOTOLINK A950RG 4.1.2cu.5268_B20221104 allows command injection via the UploadCustomModule function in lib/cste_modules/product.so. An attacker can exploit this remotely.
- Affected
- {'product': 'TOTOLINK A950RG', 'version': '4.1.2cu.5268_B20221104'}
- Fix
- Check the linked advisory for a fix
- Exploitation
- Public proof of concept
Why it is Red
- CVSS 10.0 critical
- Remotely exploitable without logging in
References
Original description
A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.
Last activity 22 Oct 2026. Patch Forecast updates every hour.