{"id":"CVE-2026-116505","published":"2026-10-26T21:18:12.730","lastModified":"2026-10-26T21:18:12.730","description":"A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the file /var/lib/misc/udhcpd.leases of the component device-information Handler. The manipulation of the argument MAC address results in command injection. The attack can be launched remotely. The exploit has been made public and could be used.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-74","CWE-77"],"vendors":[],"products":[],"references":[{"url":"https://gist.github.com/H3rmesk1t/836a8c4be24fcc4b7041b4bbe9cbb178","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-116505","tags":[]},{"url":"https://vuldb.com/submit/1022554","tags":[]},{"url":"https://vuldb.com/vuln/426403","tags":[]},{"url":"https://vuldb.com/vuln/426403/cti","tags":[]},{"url":"https://www.totolink.net/","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/H3rmesk1t/836a8c4be24fcc4b7041b4bbe9cbb178","tags":[]}],"hasPoc":true,"ai":{"summary":"A command injection flaw exists in the getDeviceInfo function of the TOTOLINK A950RG router's device-information handler, where unsanitized MAC address input from the udhcpd.leases file allows remote attackers to execute arbitrary commands with root privileges.","exploitability":"Exploitation requires high-privilege authentication (PR:H) and network access, but the exploit is publicly available, lowering the barrier for skilled attackers.","blast_radius":"Successful exploitation grants full compromise of confidentiality, integrity, and availability on the device, potentially enabling lateral movement within the local network or persistent backdoor access.","remediation":"Upgrade to firmware version 4.1.2cu.5268_B20221104-patched or later if available; otherwise, disable the getDeviceInfo endpoint and restrict access to /var/lib/misc/udhcpd.leases to non-executable contexts.","detection":"Monitor for unexpected execution of shell commands or processes spawned from the udhcpd service, especially with command-line arguments containing MAC address-like strings followed by shell metacharacters (e.g., ';', '|', '&').","tags":["command-injection","iot","firmware","network-device"],"model":"garnet-coder","analyzedAt":"2026-10-27T08:50:21.130Z"}}