Product
A flaw in the TOTOLINK A950RG (version 4.1.2cu.5268_B20221104) function UploadCustomModule allows for remote command injection via manipulation of the FileMd5 argument.