CVE-2026-116504 in A950RG
Summary
by MITRE • 10/26/2026
A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in TOTOLINK A950RG firmware version 4.1.2cu.5268_B20221104 represents a critical security flaw within the device's cloud-based firmware update mechanism. Specifically, this issue resides in the setCloudUpgradeFW function located within the lib/cste_modules/upgrade.so library component responsible for handling Cloud Upgrade operations. The core technical deficiency is a command injection vulnerability triggered by improper validation and sanitization of the FileName argument passed to this function. When an attacker provides a maliciously crafted filename containing shell metacharacters or specific payload sequences, the underlying system processes these inputs as executable commands rather than treating them strictly as file path identifiers. This lack of input validation allows for arbitrary command execution on the compromised device with the privileges associated with the service running the upgrade module, which is typically root-level access in embedded IoT environments.
From an operational perspective, this vulnerability poses a severe risk to network integrity and data confidentiality because it can be exploited remotely without requiring any form of authentication or prior user interaction. An attacker located on the same local network segment or potentially over the internet if cloud services are misconfigured could initiate the attack vector by interacting with the firmware update interface. The successful exploitation leads to complete system compromise, enabling the adversary to install persistent backdoors, exfiltrate sensitive configuration data such as Wi-Fi credentials and ISP settings, or pivot into other devices on the internal network. Given that this exploit has been publicly disclosed, automated scanning tools and malicious actors are likely already leveraging it against vulnerable instances, making immediate remediation urgent for any deployed units running the affected firmware version.
In terms of industry standard classification, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. The attack technique corresponds to ATT&CK ID T1059 which covers command and script interpretation, specifically focusing on the execution of system-level commands through vulnerable application interfaces. To mitigate this risk, administrators must immediately update the TOTOLINK A950RG firmware to a patched version where the FileName parameter is strictly validated against an allowlist or properly escaped before being passed to the operating system shell functions. Additionally, network segmentation strategies should be employed to isolate IoT devices from critical infrastructure and sensitive data stores until all vulnerable units are remediated. Monitoring network traffic for unusual outbound connections or unexpected process executions can also aid in detecting potential exploitation attempts while patching efforts are underway.