{"id":"CVE-2026-114575","published":"2026-10-22T01:16:58.533","lastModified":"2026-10-22T15:15:23.833","description":"A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-74","CWE-77"],"vendors":[],"products":[],"references":[{"url":"https://gist.github.com/H3rmesk1t/3a629799af33425e07571182e539a794","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-114575","tags":[]},{"url":"https://vuldb.com/submit/1021292","tags":[]},{"url":"https://vuldb.com/vuln/424943","tags":[]},{"url":"https://vuldb.com/vuln/424943/cti","tags":[]},{"url":"https://www.totolink.net/","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/H3rmesk1t/3a629799af33425e07571182e539a794","tags":[]}],"hasPoc":true,"ai":{"summary":"A command injection flaw exists in the UploadCustomModule function of the TOTOLINK A950RG router's product.so library, where unsanitized input from the FileMd5 argument allows remote attackers to inject and execute arbitrary OS commands.","exploitability":"Exploitation is trivial for remote attackers as it requires only sending a crafted HTTP request with a malicious FileMd5 parameter and no authentication or user interaction is needed.","blast_radius":"Successful exploitation grants full system compromise of the router, enabling complete takeover of network traffic, credential theft, and lateral movement within the local network.","remediation":"Upgrade to firmware version 4.1.2cu.5268_B20221104 patch level B2023xxxx or later if available; otherwise, disable the Custom Module Upload feature and restrict access to the affected endpoint until a patch is applied.","detection":"Look for HTTP POST requests to /lib/cste_modules/product.so with unusually long or shell-metacharacter-containing FileMd5 values in web server or application logs; also monitor for subsequent execution of unexpected processes (e.g., sh, wget, curl) spawned by the router's web service process.","tags":["rce","command-injection","iot","router","firmware"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:46:55.471Z"}}