CVE-2026-116506Critical· 9.9▾ MidnightA vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function apmib_set of the file firewall.so. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 54.5 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
1.9%
A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function apmib_set of the file firewall.so. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
A950RG 4.1.2cu.5268_B20221104Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116505Critical· 9.1TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection
CVE-2026-116504Critical· 9.9TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection
CVE-2026-114575Critical· 10.0TOTOLINK A950RG product.so UploadCustomModule command injection
CVE-2026-93742Critical· 9.9A weakness has been identified in Totolink A3002MU Hh-B20211125.1046
CVE-2026-116507Medium· 5.3TOTOLINK A950RG global.so getLanguageCfg information disclosure
CVE-2026-116508Critical· 10.0TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow