CVE-2026-116505: TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection
Published Oct 26, 2026
·Updated
A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268B20221104. This impacts the function getDeviceInfo of the file /var/lib/misc/udhcpd.leases of the component device-information Handler. The manipulation of the argument MAC address results in command injection. The attack can be launched remotely. The exploit has been made public and could be used.
Affected Software
1 affected component
TOTOLINK A950RG=4.1.2cu.5268_B20221104
Event History
Oct 26, 2026
CVE Published
via MITRE·08:45 PM
Data Sourced
via MITRE·08:45 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Exploitation requires high privileges and can be launched remotely. No user interaction is required.
2
What input is used to trigger the vulnerability?
The vulnerable getDeviceInfo function processes a MAC address argument. Manipulating that argument can result in command injection.
3
Is public exploit information available?
Yes. The exploit has been made public and could be used.
4
Which firmware version is identified as affected?
The reported affected version is TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104.