CVE-2026-116506: TOTOLINK A950RG firewall.so apmib_set command injection

Published Oct 26, 2026

Updated

A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268B20221104. Affected is the function apmibset of the file firewall.so. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

Event History

Oct 26, 2026

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

TOTOLINK A950RG devices running version 4.1.2cu.5268_B20221104 are identified as affected. The attack can be initiated remotely, so devices reachable over the network are exposed.

What level of access does an attacker need?

The vector indicates low privileges are required and no user interaction is needed. The available data does not identify the specific account type or interface required.

Is exploit code available?

Yes. The exploit has been publicly disclosed and may be used.

CVE-2026-116506: TOTOLINK A950RG firewall.so apmib_set command injection

Event History

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

What level of access does an attacker need?

Is exploit code available?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

What level of access does an attacker need?

Is exploit code available?