Summary
generated automatically from NVD dataTOTOLINK A950RG firmware version 4.1.2cu.5268_B20221104 contains a command injection flaw in the getDeviceInfo function of the device-information Handler component, which works with the file /var/lib/misc/udhcpd.leases. Manipulating the MAC address argument lets an attacker inject commands, and the attack can be launched remotely. A public exploit is reported to exist, and the issue is rated CRITICAL with a CVSS v3.1 score of 9.1 (CWE-74).
NVD description
A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the file /var/lib/misc/udhcpd.leases of the component device-information Handler. The manipulation of the argument MAC address results in command injection. The attack can be launched remotely. The exploit has been made public and could be used.
In-depth analysis on cveo.tech
This CVE is covered in an article: context, affected versions and published fixes.
CVSS v3.1 Score
Information
- Published
- 26 oct. 2026
- Updated
- 26 oct. 2026
- Status
- Received
- Source
- cna@vuldb.com
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-74
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.