TOTOLINK A950RG: Remote command injection via UploadCustomModule (CVE-2026-114575)
A flaw in the TOTOLINK A950RG (version 4.1.2cu.5268_B20221104) function UploadCustomModule allows for remote command injection via manipulation of the FileMd5 argument.
CVE search metadata
CVE search record: CVE-2026-114575. Severity: critical. CVSS: 10.0. KEV: no. Product: A950RG (4.1.2cu.5268_B20221104). Brief: TOTOLINK A950RG: Remote command injection via UploadCustomModule (CVE-2026-114575). Brief link: https://feed.craftedsignal.io/briefs/2026-10-totolink-cve-2026-114575/
Triage facts
Revision 1- Applicability
- A950RG (4.1.2cu.5268_B20221104)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Oct 22, 01:51 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A remote command injection vulnerability (CVE-2026-114575) exists in the TOTOLINK A950RG router, firmware version 4.1.2cu.5268_B20221104. The vulnerability is located in the UploadCustomModule function of the lib/cste_modules/product.so file. Exploitation is achieved by manipulating the FileMd5 argument. Proof-of-concept exploit code has been published.