---
id: CVE-2026-116504
title: TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection
summary: >-
  A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This
  affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so
  of the component Cloud Upgrade. The manipulation of the argument FileName
  leads…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'
cvssSource: cna
cwe:
  - CWE-77
  - CWE-74
vendor: TOTOLINK
product: A950RG
affected:
  - A950RG 4.1.2cu.5268_B20221104
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-27T14:06:36.678372Z'
exploitAvailable: true
published: '2026-10-26'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T14:18:09.375Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116504'
references:
  - url: 'https://vuldb.com/vuln/426402'
    label: >-
      VDB-426402 | TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW
      command injection
  - url: 'https://vuldb.com/vuln/426402/cti'
    label: 'VDB-426402 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-116504'
    label: CVE-2026-116504 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1022553'
    label: >-
      Submit #1022553 | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Command
      Injection
  - url: 'https://gist.github.com/H3rmesk1t/c2f2dcfdb6238a7ddb8fb0622ad52948'
  - url: 'https://www.totolink.net/'
tags:
  - cve.org
  - exploit-available
epss: 0.01547
epssPercentile: 0.75122
ingestedAt: '2026-10-26T20:39:42.613Z'
---

## Overview

A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

## Affected

- `A950RG 4.1.2cu.5268_B20221104`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.