Vulnerability details

CVE-2026-114575

Totolink A950RG

TOTOLINK A950RG product.so UploadCustomModule command injection

CVSS 4.0

10.0Critical

Official description

A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.

CVSS scores

Score	Version	Source	Vector
10.0Critical	4.0	CVEProject cvelistV5 (CNA) (VulDB)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P`
10.0Critical	3.1	CVEProject cvelistV5 (CNA) (VulDB)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R`
10.0Critical	3.0	CVEProject cvelistV5 (CNA) (VulDB)	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R`
10.0High	2.0	CVEProject cvelistV5 (CNA) (VulDB)	`AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR`

Affected products

Vendor	Product	Versions	Source
Totolink	A950RG	4.1.2cu.5268_B20221104	CVEProject cvelistV5 (CNA)

References and advisories

https://vuldb.com/vuln/424943 vdb-entrytechnical-description
https://vuldb.com/vuln/424943/cti signaturepermissions-required
https://vuldb.com/cve/CVE-2026-114575 third-party-advisory
https://vuldb.com/submit/1021292 third-party-advisory
https://gist.github.com/H3rmesk1t/3a629799af33425e07571182e539a794 exploit
https://www.totolink.net/ product

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-22
Last updated: 2026-10-28
State: Published
Assigner (CNA): VulDB
Kolun priority: 46 · Medium

Exploit prediction (EPSS)

2.21%

Probability of exploitation in 30 days

82.7%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-77
Command Injection
CWE-74
Injection