CVE-2026-114575

Summary

A command injection flaw exists in the UploadCustomModule function of the TOTOLINK A950RG router's product.so library, where unsanitized input from the FileMd5 argument allows remote attackers to inject and execute arbitrary OS commands.

Exploitability

Exploitation is trivial for remote attackers as it requires only sending a crafted HTTP request with a malicious FileMd5 parameter and no authentication or user interaction is needed.

Blast radius

Successful exploitation grants full system compromise of the router, enabling complete takeover of network traffic, credential theft, and lateral movement within the local network.

Detection

Look for HTTP POST requests to /lib/cste_modules/product.so with unusually long or shell-metacharacter-containing FileMd5 values in web server or application logs; also monitor for subsequent execution of unexpected processes (e.g., sh, wget, curl) spawned by the router's web service process.

Prioritized remediation

Upgrade to firmware version 4.1.2cu.5268_B20221104 patch level B2023xxxx or later if available; otherwise, disable the Custom Module Upload feature and restrict access to the affected endpoint until a patch is applied.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.