Summary
generated automatically from NVD dataTOTOLINK A950RG firmware version 4.1.2cu.5268_B20221104 contains a command injection flaw in the UploadCustomModule function of lib/cste_modules/product.so. Manipulating the FileMd5 argument allows an attacker to inject commands, and the attack can be launched remotely. A public exploit has been published, and the vulnerability is rated CRITICAL with a CVSS v3.1 score of 10.0 (weakness CWE-74).
NVD description
A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.
EPSS · FIRST.org
2.2%probability of exploitation in the next 30 days
Higher than 82% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-24, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 22 oct. 2026
- Updated
- 22 oct. 2026
- Status
- Deferred
- Source
- cna@vuldb.com
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-74
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.