CVE-2026-114575

CRITICAL

A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.

CVSS v3.1 Score

10.0
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Published: 10/22/2026Modified: 10/28/2026

Related Intelligence (1)

CRITICALVulnerability

NVD CRITICAL: CVE-2026-114575 — A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by thi...

A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.

CVE-2026-114575
NIST NVD

References (6)

https://gist.github.com/H3rmesk1t/3a629799af33425e07571182e539a794https://vuldb.com/cve/CVE-2026-114575https://vuldb.com/submit/1021292https://vuldb.com/vuln/424943https://vuldb.com/vuln/424943/ctihttps://www.totolink.net/