{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/a950rg-4.1.2cu.5268_b20221104/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:totolink:a950rg:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2026-114575"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["A950RG (4.1.2cu.5268_B20221104)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["TOTOLINK"],"content_html":"\u003cp\u003eA remote command injection vulnerability (CVE-2026-114575) exists in the TOTOLINK A950RG router, firmware version 4.1.2cu.5268_B20221104. The vulnerability is located in the UploadCustomModule function of the lib/cste_modules/product.so file. Exploitation is achieved by manipulating the FileMd5 argument. Proof-of-concept exploit code has been published.\u003c/p\u003e\n","date_modified":"2026-10-22T01:51:22Z","date_published":"2026-10-22T01:51:22Z","id":"https://feed.craftedsignal.io/briefs/2026-10-totolink-cve-2026-114575/","summary":"A flaw in the TOTOLINK A950RG (version 4.1.2cu.5268_B20221104) function UploadCustomModule allows for remote command injection via manipulation of the FileMd5 argument.","title":"TOTOLINK A950RG: Remote command injection via UploadCustomModule (CVE-2026-114575)","url":"https://feed.craftedsignal.io/briefs/2026-10-totolink-cve-2026-114575/"}],"language":"en","title":"CraftedSignal Threat Feed - A950RG (4.1.2cu.5268_B20221104)","version":"https://jsonfeed.org/version/1.1"}