Critical Command Injection Flaw Found in TOTOLINK A950RG Router Firmware

A critical security vulnerability has been identified in TOTOLINK A950RG routers, allowing remote attackers to execute arbitrary commands on the device. The flaw, tracked as CVE-2026-114575, was recorded by the National Vulnerability Database with a maximum CVSS score of 10. This rating indicates that the issue poses a severe risk to network security and device integrity.

The vulnerability exists within the UploadCustomModule function located in the lib/cste_modules/product.so file. According to the NVD record, manipulating the FileMd5 argument in this function leads to command injection. This means an attacker can insert malicious operating system commands through the file hash parameter. The attack vector is remote, meaning the attacker does not need physical access to the router or a local network connection to initiate the exploit.

Technical details and attack vector

The National Vulnerability Database classifies the weaknesses associated with this flaw as CWE-77 and CWE-74. These Common Weakness Enumeration categories refer to improper neutralization of special elements used in an OS command and improper control of generation of code, respectively. The specific mechanism involves the router failing to properly sanitize the FileMd5 input.

Because the exploit code has already been published, the threat is active and available for use by malicious actors. The NVD description notes that the exploit may be used against vulnerable devices. This public availability significantly increases the likelihood of automated scanning and exploitation in the wild. Security professionals should treat this as an immediate concern for any exposed instances of the affected firmware.

Affected devices and versions

The issue specifically affects the TOTOLINK A950RG model running firmware version 4.1.2cu.5268_B20221104. This is the only version explicitly listed in the National Vulnerability Database record for CVE-2026-114575. Users of this specific firmware build are at direct risk.

Administrators should verify their current firmware version against this specific identifier to determine exposure. The NVD record does not mention other TOTOLINK models or firmware versions. Therefore, only the specified version is confirmed vulnerable based on the available data.

What should you do?

Network administrators and IT security teams should immediately audit their environments for the presence of TOTOLINK A950RG routers running the affected firmware. If this device is found in a production or public-facing network, it should be isolated or taken offline until a mitigation strategy is in place. Since the exploit allows remote command injection, blocking inbound traffic to the router’s management interface is a critical immediate step.