{"id":"CVE-2026-116504","published":"2026-10-26T21:18:12.420","lastModified":"2026-10-26T21:18:12.420","description":"A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-74","CWE-77"],"vendors":[],"products":[],"references":[{"url":"https://gist.github.com/H3rmesk1t/c2f2dcfdb6238a7ddb8fb0622ad52948","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-116504","tags":[]},{"url":"https://vuldb.com/submit/1022553","tags":[]},{"url":"https://vuldb.com/vuln/426402","tags":[]},{"url":"https://vuldb.com/vuln/426402/cti","tags":[]},{"url":"https://www.totolink.net/","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/H3rmesk1t/c2f2dcfdb6238a7ddb8fb0622ad52948","tags":[]}],"hasPoc":true,"ai":{"summary":"A command injection flaw in the TOTOLINK A950RG router's cloud upgrade feature allows remote attackers with low-privileged access to execute arbitrary commands on the device by manipulating the FileName argument in the setCloudUpgradeFW function.","exploitability":"Exploitation requires low-privileged network access (PR:L) and no user interaction (UI:N), with a publicly available exploit already disclosed.","blast_radius":"Successful exploitation grants high confidentiality, integrity, and availability impact (C:H/I:H/A:H), enabling full device compromise and potential lateral movement within the local network.","remediation":"Upgrade to firmware version 4.1.2cu.5268_B20221104 patch level beyond the vulnerable build or apply the vendor’s official security update; if no fixed version is published, disable the cloud upgrade feature and restrict access to the affected endpoint.","detection":"Look for HTTP POST requests to /cgi-bin/cstecgi.cgi targeting the setCloudUpgradeFW endpoint with suspiciously long or shell-metacharacter-laden FileName parameters in web server logs; also monitor for unexpected subprocess spawning (e.g., /bin/sh, /bin/busybox) in system logs.","tags":["command-injection","iot","firmware","rce","cloud-upgrade"],"model":"garnet-coder","analyzedAt":"2026-10-27T08:45:39.727Z"}}