CVE-2026-114575: TOTOLINK A950RG product.so UploadCustomModule command injection
A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cstemodules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue can be exploited remotely and requires no privileges or user interaction. Exploitation involves manipulating the FileMd5 argument handled by the UploadCustomModule function.
How severe is the potential impact?
The supplied severity vector indicates high confidentiality, integrity, and availability impact, with scope changed. Successful command injection could therefore affect the device beyond the vulnerable component.
Is public exploit information available?
Yes. The available data states that an exploit has been published and may be used.