CVE-2026-116505 in A950RG
Summary
by MITRE • 10/26/2026
A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the file /var/lib/misc/udhcpd.leases of the component device-information Handler. The manipulation of the argument MAC address results in command injection. The attack can be launched remotely. The exploit has been made public and could be used.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in TOTOLINK A950RG firmware version 4.1.2cu.5268_B20221104 represents a critical security flaw within the device-information handler component, specifically affecting the getDeviceInfo function associated with the udhcpd leases file located at /var/lib/misc/udhcpd.leases. This vulnerability is classified as a command injection issue, which falls under the Common Weakness Enumeration category CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection). The root cause lies in the inadequate validation and sanitization of user-supplied input, specifically the MAC address argument passed to the getDeviceInfo function. When this function processes data from the DHCP lease file, it fails to properly escape or filter special shell characters such as semicolons, pipes, ampersands, or backticks. This lack of rigorous input handling allows an attacker to inject arbitrary operating system commands that are subsequently executed by the underlying system with the privileges of the affected service process.
The operational impact of this vulnerability is severe due to its remote exploitable nature and the availability of public exploits. An unauthenticated attacker can leverage this flaw over a network connection, typically via HTTP or other exposed management interfaces, to achieve arbitrary code execution on the target router. By crafting malicious requests that manipulate the MAC address field within the DHCP lease data structure, an adversary can bypass standard authentication mechanisms if they are not strictly enforced before this specific handler is invoked, or exploit it in contexts where network-level access suffices for interaction with the vulnerable component. Successful exploitation grants the attacker full control over the device's operating system shell, enabling them to read sensitive configuration files, modify routing tables, install persistent backdoors, pivot into internal networks, and potentially launch further attacks against other devices on the local subnet. This effectively compromises the confidentiality, integrity, and availability of both the router itself and any connected network infrastructure.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, specifically T1059: Command and Scripting Interpreter, and potentially T1136: Internal Network Discovery if used for reconnaissance purposes following initial access. The presence of public exploits significantly lowers the barrier to entry for malicious actors, increasing the likelihood of automated scanning and widespread compromise across devices running this specific firmware version. Attackers often utilize such vulnerabilities in botnet recruitment campaigns or as an initial foothold for more sophisticated intrusion sets targeting IoT infrastructure.
Mitigation strategies must prioritize immediate remediation through vendor-supplied patches that address the input validation logic within the getDeviceInfo function. Developers should implement strict allow-listing for MAC addresses, ensuring only valid hexadecimal characters are accepted and rejecting any input containing shell metacharacters or unexpected symbols. Additionally, employing parameterized commands rather than string concatenation when invoking system utilities can prevent injection attacks at the code level. For organizations unable to immediately patch, network segmentation is recommended to isolate affected devices from critical internal resources. Monitoring for anomalous outbound connections or unusual process executions originating from IoT device IP addresses can also aid in detecting active exploitation attempts while patches are being deployed. Regular firmware updates and disabling unnecessary remote management features remain essential best practices for maintaining the security posture of connected home routers.