CVE-2026-116506

Summary

Command injection flaw in TOTOLINK A950RG firmware's firewall.so via apmib_set function allows unauthenticated remote attackers to execute arbitrary commands on the device.

Exploitability

Exploitation requires low-privilege network access and knowledge of the vulnerable endpoint; public exploits exist, making it accessible to automated tooling.

Blast radius

Successful exploitation grants full system compromise—confidentiality, integrity, and availability impact—potentially enabling botnet recruitment, data theft, or pivot into internal networks.

Detection

Look for HTTP POST requests to /cgi-bin/firewall.so or similar admin endpoints containing suspicious parameter values (e.g., shell metacharacters like ;, |, $(...), or backticks) in firewall configuration logs; also monitor for unexpected process spawns of /bin/sh or /bin/bash from the web server context.

Prioritized remediation

Upgrade to firmware version 4.1.2cu.5268_B20221104 patch level beyond the affected build (e.g., B2023xxxx or later if confirmed fixed by TOTOLINK); until then, disable remote management and restrict firewall.so access to localhost only.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.