CVE-2026-116505

Summary

A command injection flaw exists in the getDeviceInfo function of the TOTOLINK A950RG router's device-information handler, where unsanitized MAC address input from the udhcpd.leases file allows remote attackers to execute arbitrary commands with root privileges.

Exploitability

Exploitation requires high-privilege authentication (PR:H) and network access, but the exploit is publicly available, lowering the barrier for skilled attackers.

Blast radius

Successful exploitation grants full compromise of confidentiality, integrity, and availability on the device, potentially enabling lateral movement within the local network or persistent backdoor access.

Detection

Monitor for unexpected execution of shell commands or processes spawned from the udhcpd service, especially with command-line arguments containing MAC address-like strings followed by shell metacharacters (e.g., ';', '|', '&').

Prioritized remediation

Upgrade to firmware version 4.1.2cu.5268_B20221104-patched or later if available; otherwise, disable the getDeviceInfo endpoint and restrict access to /var/lib/misc/udhcpd.leases to non-executable contexts.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.