TOTOLINK A950RG CVE-2026-116505

Exploitation targets the getDeviceInfo function of the device-information handler, which reads attacker-influenced MAC-address data from the DHCP lease file /var/lib/misc/udhcpd.leases on the TOTOLINK A950RG (firmware 4.1.2cu.5268_B20221104); a MAC value containing shell metacharacters is the injection vector. LIMITING FACTORS: the CVSS vector specifies PR:H, so high privileges are required to reach the vulnerable code path, and the flaw is specific to this product and firmware build; the available sources do NOT describe exactly how the malicious MAC reaches the lease file (e.g. whether via an unauthenticated LAN DHCP request or via authenticated configuration), so the precise unauthenticated reachability is not confirmed from available data.

This is a command injection flaw (CWE-77) in the TOTOLINK A950RG router's device-information handler, where a MAC address value read from /var/lib/misc/udhcpd.leases is passed unsanitized to a command context by getDeviceInfo. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, impacts VC/VI/VA:H) scores 8.5 and indicates network reachability with low complexity but HIGH privileges required (PR:H) - so this is not an unauthenticated internet-wide threat as presented. EPSS is moderate at 2.74% (86th percentile), above typical baseline but far from the high-probability tier, and the vuln.today decision label is 'this_week' rather than act_now/emergency. It is NOT listed in CISA KEV, so there is no confirmed active exploitation. A public PoC reference (a GitHub gist) exists but is flagged in the input as not verified as working exploit code. CONFLICTING SIGNAL TO VERIFY: the description says 'The attack can be launched remotely' while the vector requires PR:H (authenticated/privileged); the actual privilege level and whether the malicious MAC can be injected by an unauthenticated LAN DHCP client versus only via authenticated configuration is not resolved by the available sources - verify with the vendor/advisory. Net: a genuinely high-severity device-takeover bug on a consumer router, but the PR:H prerequisite and the unverified PoC lower its real-world priority below an internet-facing unauthenticated RCE.

An attacker able to influence a DHCP lease MAC value stored in udhcpd.leases crafts a MAC-address string containing shell metacharacters; when the router's getDeviceInfo device-information handler processes that lease, the embedded command executes on the device. A public PoC reference (gist) exists but is not verified as working exploit code, and the CVSS vector indicates high privileges are required to reach the vulnerable path.