CVE-2026-116504

critical

Description

A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

References

https://www.totolink.net/

https://vuldb.com/vuln/426402/cti

https://vuldb.com/vuln/426402

https://vuldb.com/submit/1022553

https://vuldb.com/cve/CVE-2026-116504

https://gist.github.com/H3rmesk1t/c2f2dcfdb6238a7ddb8fb0622ad52948

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-110321

Details

Source: Mitre, NVD

Published: 2026-10-26

Updated: 2026-10-27

Risk Information

CVSS v2

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 9.9

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 9.4

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Severity: Critical

EPSS

EPSS: 0.01547