TOTOLINK A950RG CVE-2026-116504

Exploitation requires the attacker to reach the router's Cloud Upgrade feature and invoke the setCloudUpgradeFW function (in lib/cste_modules/upgrade.so), supplying a malicious FileName argument that is passed unsafely to an OS command. The CVSS vector specifies PR:L, so a low-privilege authenticated session on the device is required - this is not unauthenticated exploitation, which meaningfully limits remote mass abuse. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The flaw is tied to one firmware build (4.1.2cu.5268_B20221104) of the A950RG, so only that model/version is confirmed affected; the precise request format and whether the Cloud Upgrade feature must be enabled or reachable from the WAN are not described in the available sources.

This is a command injection (CWE-77) in the Cloud Upgrade component of the TOTOLINK A950RG router, with signals pointing to a moderate-but-not-emergency priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network reach, low complexity, and no user interaction, but PR:L means some authentication is required, which limits unauthenticated mass exploitation. EPSS is 1.55% (75th percentile) - modest, consistent with the vuln.today decision label of 'this_week' rather than 'act_now' or 'emergency'. The vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation; a public PoC reference exists (a GitHub gist) but it is not verified as working exploit code, so POC availability must not be conflated with exploitation. Note a conflict worth flagging: the input CVSS 4.0 vector asserts subsequent-system impact (SC:H/SI:H/SA:H) and privileges PR:L, yet the description gives no detail on the triggering mechanism or the scope of compromise beyond the device itself - treat the subsequent-system impact as unverified. Overall: a genuine high-severity device-compromise flaw, but the authentication requirement, consumer-router footprint, and low EPSS make this a prioritized-patch item rather than a drop-everything emergency.

An attacker with low-privilege access to the router's management interface sends a request to the Cloud Upgrade feature with a crafted FileName argument to setCloudUpgradeFW, injecting OS commands that execute on the device. A public PoC reference (GitHub gist) exists but is not verified as working exploit code. Because the CVSS vector is network-based with low complexity and no user interaction, exploitation is straightforward once the required low-privilege access is obtained.