Vulnerability · Published Oct 26, 2026 · Assigned by VulDB

CVE-2026-116504TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection

Critical 9.9

In plain English

A critical-severity command injection in A950RG from TOTOLINK. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)1.5%top 24.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
TOTOLINK	A950RG	4.1.2cu.5268_B20221104

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

References

VDB-426402 | TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection vdb-entry, technical-description
VDB-426402 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-116504 | CVE Analysis and Report third-party-advisory
Submit #1022553 | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Command Injection third-party-advisory
https://gist.github.com/H3rmesk1t/c2f2dcfdb6238a7ddb8fb0622ad52948 exploit
https://www.totolink.net/ product