{"id":"CVE-2026-116506","published":"2026-10-26T21:18:13.047","lastModified":"2026-10-26T21:18:13.047","description":"A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function apmib_set of the file firewall.so. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-74","CWE-77"],"vendors":[],"products":[],"references":[{"url":"https://gist.github.com/H3rmesk1t/1046036a8601e93f375754e11307bfc8","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-116506","tags":[]},{"url":"https://vuldb.com/submit/1022555","tags":[]},{"url":"https://vuldb.com/vuln/426404","tags":[]},{"url":"https://vuldb.com/vuln/426404/cti","tags":[]},{"url":"https://www.totolink.net/","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/H3rmesk1t/1046036a8601e93f375754e11307bfc8","tags":[]}],"hasPoc":true,"ai":{"summary":"Command injection flaw in TOTOLINK A950RG firmware's firewall.so via apmib_set function allows unauthenticated remote attackers to execute arbitrary commands on the device.","exploitability":"Exploitation requires low-privilege network access and knowledge of the vulnerable endpoint; public exploits exist, making it accessible to automated tooling.","blast_radius":"Successful exploitation grants full system compromise—confidentiality, integrity, and availability impact—potentially enabling botnet recruitment, data theft, or pivot into internal networks.","remediation":"Upgrade to firmware version 4.1.2cu.5268_B20221104 patch level beyond the affected build (e.g., B2023xxxx or later if confirmed fixed by TOTOLINK); until then, disable remote management and restrict firewall.so access to localhost only.","detection":"Look for HTTP POST requests to /cgi-bin/firewall.so or similar admin endpoints containing suspicious parameter values (e.g., shell metacharacters like ;, |, $(...), or backticks) in firewall configuration logs; also monitor for unexpected process spawns of /bin/sh or /bin/bash from the web server context.","tags":["command-injection","iot","firewall","rce","firmware"],"model":"garnet-coder","analyzedAt":"2026-10-27T08:45:51.720Z"}}