TOTOLINK A950RG EUVD-2026-110464

Exploitation requires network access to the device management interface of the TOTOLINK A950RG (firmware 4.1.2cu.5268_B20221104) and at least low-privilege authentication (PR:L) to reach the vulnerable apmib_set handler in firewall.so; it is not an unauthenticated-against-default-config flaw. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must possess or obtain valid low-level credentials or an authenticated session, the management interface must be reachable from the attacker's position (often LAN-side unless remote administration is enabled), and only the specific affected firmware build is confirmed. The exact parameter and injection trigger are not detailed in the available sources beyond the named function and file.

Signals are moderately aligned toward near-term priority but stop short of an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity command injection requiring low-level privileges (PR:L), with high impact to confidentiality, integrity and availability - consistent with authenticated root-level command execution on an embedded router. EPSS is 1.88% (79th percentile): elevated relative to the average CVE but not indicative of mass exploitation. The vuln.today decision label is 'this_week', implying prompt but non-emergency remediation. A public PoC reference exists (E:P in the vector plus a GitHub gist), yet there is NO CISA KEV listing and no confirmation of active exploitation, so PoC availability must not be read as in-the-wild use. The one notable tension: the input 4.0 vector sets subsequent-system impact SC:H/SI:H/SA:H (a scope change to other systems), which is not substantiated by the one-line description of command injection in firewall.so on a single device - this appears to overstate cascading impact and should be treated with caution. Net: a genuine, remotely reachable device-compromise flaw that warrants scheduled patching, but current evidence points to opportunistic/targeted rather than widespread automated exploitation.

An attacker with low-privilege access to the router's management interface (AV:N/PR:L) sends a crafted request reaching the apmib_set function in firewall.so, injecting shell metacharacters into a parameter that is passed to an OS command. Because a public PoC reference exists (a GitHub gist), the technical trigger path is at least partially documented, lowering the barrier to reproduction, though it is not verified as working exploit code.