TOTOLINK A950RG, Oray X5 Pro, Unitree Go2: 8 Critical CVEs With Public Exploits in Embedded Devices

Between October 24 and 26, 2026, NVD received eight critical CVEs covering three embedded devices: the TOTOLINK A950RG router, the Oray Pugongying X5 Pro router and the Unitree Go2 quadruped robot. All eight were filed by VulDB as CNA, and every description states that the exploit has been made public.

The A950RG is a repeat offender: the very same firmware build was already hit by CVE-2026-114575, covered in our October SOHO router roundup. Four more flaws now join it.

All scores come from VulDB. The TOTOLINK entries are in NVD status Received, the Oray and Unitree ones in Deferred; none carries a CPE configuration. None is in the CISA KEV catalog at the time of writing.

TOTOLINK A950RG — four CVEs on firmware 4.1.2cu.5268_B20221104

CVE-2026-116508 — vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0). Stack-based buffer overflow in function sub_402340 of infostat.cgi (the device-information CGI), through the CONTENT_LENGTH variable. This is the worst of the batch: no authentication required per the vector, and the manipulated value is a standard HTTP header that every client sends.

CVE-2026-116506 — vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.9). Command injection in the apmib_set function of firewall.so.

CVE-2026-116504 — vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.9). Command injection in setCloudUpgradeFW in lib/cste_modules/upgrade.so (the "cloud" firmware upgrade feature), through the FileName parameter.

CVE-2026-116505 — vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (9.1). Command injection in getDeviceInfo, through the MAC address read from /var/lib/misc/udhcpd.leases, the DHCP lease file. In other words, a value that originates from clients on the network ends up inside a system command. The vector requires high privileges.

Oray Pugongying X5 Pro — three CRLF injections in version 7.6.1

All three flaws work the same way: a parameter accepts line breaks, which are then written verbatim into the configuration file of a system service. That lets an attacker append their own directives.

• CVE-2026-116231 — AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.9): ser2net component, regmsg parameter. The researcher's write-up cited as a reference is titled as ser2net overwriting existing files.
• CVE-2026-116234 — AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (9.1): IPsec policy handler, /etc/ipsec.conf, secproto parameter. The referenced write-up describes it as root code execution.
• CVE-2026-116233 — AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (9.1): Dnsmasq component, rent_time parameter (DHCP lease time).

One detail matters: according to the descriptions, Oray was contacted before disclosure and did not respond. No fix has been announced.

Unitree Go2 — CVE-2026-115995

Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (9.6)

OS command injection in the set_volume function of gpt_thread.py, in the chat_go component, through the Value argument. The vector requires no privileges but does require user interaction (UI:R).

This is the only one of the eight with a clear resolution: Unitree confirmed the flaw (internal ticket 474), and the description states that version 1.1.11.5 fixes it. Affected versions run up to and including 1.1.11.4.

What these flaws mean

On devices like these, the affected services (web CGI, Dnsmasq, IPsec, ser2net) usually run with full system privileges. A command or directive injection there effectively means complete control of the device, which is what the S:C in every vector reflects.

The vectors requiring low or high privileges are not much comfort on this class of hardware: authentication often boils down to a single admin password, sometimes the factory default. And a public exploit for an unpatched router is a natural target for botnets — that's an inference, as no exploitation is documented in these NVD entries.

Affected versions

For TOTOLINK and Oray, the descriptions cite a single tested version. That doesn't mean other versions are safe. Check each model's support page.

Detection

• Inventory: look for these models on your network, including branch sites and remote workers' homes. For the Go2, record the firmware version.
• Exposure: make sure no admin interface is reachable from the internet.
• Suspicious requests in logs, where available: calls to infostat.cgi with an abnormal Content-Length, FileName parameters containing shell metacharacters.
• Configuration (Oray): review ipsec.conf and the Dnsmasq and ser2net configurations for directives you didn't add.
• Behavior: unusual outbound traffic, changed DNS settings, unexplained reboots.

Mitigation

1. Unitree Go2: upgrade to 1.1.11.5 or later.
2. Disable remote administration on the TOTOLINK and Oray routers.
3. Change factory admin passwords: most of these flaws require an account, even a low-privileged one.
4. Isolate unpatched devices in a separate segment with no access to workstations and servers.
5. Replace models that won't get a fix, especially when the vendor ignores vulnerability reports.

Why continuous monitoring matters for embedded devices

These eight CVEs have no CPE, and most will never be analyzed by NIST. Monitoring that relies on CPE matches alone won't see them; you also need to search by product name.

With cveo.tech, inventory your routers and connected devices with their exact model and version, and get an alert as soon as a CVE mentions them — even when NVD hasn't analyzed it.