TOTOLINK A950RG CVE-2026-114575

Exploitation requires reaching the router's management service that exposes the UploadCustomModule function (lib/cste_modules/product.so) and supplying a crafted FileMd5 argument containing shell metacharacters that is passed to a system command. The CVSS vector claims PR:N/UI:N (no authentication, no user interaction) against TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104, but the description does not explicitly state the endpoint is pre-authentication, so a limiting factor may be that the attacker must first have access to the authenticated management session or to a network position (LAN, or WAN only if remote management is enabled) from which the interface is reachable. Exploitation is constrained to this specific device model and firmware build.

All available signals point to a genuinely high-risk, easy-to-exploit flaw, though the deployment footprint tempers the overall priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and the VC:H/VI:H/VA:H impact ratings reflect a command-injection flaw that yields full control of the device - consistent with CWE-74 and the described injection of the FileMd5 argument into the UploadCustomModule function. The 9.3 score and the Exploit Maturity sub-metric E:P (proof-of-concept) are reinforced by a publicly available exploit (a GitHub gist by H3rmesk1t), so the barrier to exploitation is low. However, this is a CVSS-4.0-only assessment from a single CNA (VulDB); there is no EPSS score, no SSVC decision data, and no CISA KEV listing provided, so there is no evidence of active, widespread exploitation - only that working exploit code exists. The PR:N (unauthenticated) rating should be treated with caution: many TOTOLINK upload/config functions are reachable only after authentication, and the description does not explicitly confirm the pre-auth reachability of UploadCustomModule - verify authentication requirements with the vendor or the published PoC. Net: a real priority for anyone running the affected hardware, but likely opportunistic/targeted rather than mass-exploited given the niche consumer-router footprint and absence of KEV/EPSS corroboration.

An attacker who can reach the router's web/management interface sends a request to the UploadCustomModule handler with a malicious FileMd5 argument containing shell metacharacters, which is passed unsanitized to a system command and executed on the device. Because published proof-of-concept exploit code exists (GitHub gist), an attacker can reproduce this reliably; successful exploitation typically runs commands as root on the embedded Linux firmware, giving full device takeover.