Cpe:2.3:a:totolink:a950rg:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3atotolinka950rg/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 01:51:22 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgTOTOLINK A950RG: Remote command injection via UploadCustomModule (CVE-2026-114575)https://feed.craftedsignal.io/briefs/2026-10-totolink-cve-2026-114575/Thu, 22 Oct 2026 01:51:22 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-totolink-cve-2026-114575/A flaw in the TOTOLINK A950RG (version 4.1.2cu.5268_B20221104) function UploadCustomModule allows for remote command injection via manipulation of the FileMd5 argument.<p>A remote command injection vulnerability (CVE-2026-114575) exists in the TOTOLINK A950RG router, firmware version 4.1.2cu.5268_B20221104. The vulnerability is located in the UploadCustomModule function of the lib/cste_modules/product.so file. Exploitation is achieved by manipulating the FileMd5 argument. Proof-of-concept exploit code has been published.</p> criticaladvisory