CVE-2026-116504

Summary

A command injection flaw in the TOTOLINK A950RG router's cloud upgrade feature allows remote attackers with low-privileged access to execute arbitrary commands on the device by manipulating the FileName argument in the setCloudUpgradeFW function.

Exploitability

Exploitation requires low-privileged network access (PR:L) and no user interaction (UI:N), with a publicly available exploit already disclosed.

Blast radius

Successful exploitation grants high confidentiality, integrity, and availability impact (C:H/I:H/A:H), enabling full device compromise and potential lateral movement within the local network.

Detection

Look for HTTP POST requests to /cgi-bin/cstecgi.cgi targeting the setCloudUpgradeFW endpoint with suspiciously long or shell-metacharacter-laden FileName parameters in web server logs; also monitor for unexpected subprocess spawning (e.g., /bin/sh, /bin/busybox) in system logs.

Prioritized remediation

Upgrade to firmware version 4.1.2cu.5268_B20221104 patch level beyond the vulnerable build or apply the vendor’s official security update; if no fixed version is published, disable the cloud upgrade feature and restrict access to the affected endpoint.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.