Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.5
CVE-2026-116505: TOTOLINK A950RG allows remote command injection via MAC
CVE-2026-116505 · published 1 day ago
Summary
The A950RG router running version 4.1.2cu.5268_B20221104 can be tricked into running unauthorized commands when an attacker supplies a crafted MAC address to the device information function. This can be done over the network without needing physical access, and an exploit is already publicly available. Update the router firmware to the latest version or disable the vulnerable feature until a patch is applied.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| totolink | a950rg | 4.1.2cu.5268_B20221104 |
Original advisory text
TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection
A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the file /var/lib/misc/udhcpd.leases of the component device-information Handler. The manipulation of the argument MAC address results in command injection. The attack can be launched remotely. The exploit has been made public and could be used.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
8.5
High
Type
CWE-77Command Injection
CWE-74Injection
Timeline
Published26 Oct 2026
Updated27 Oct 2026
First seen26 Oct 2026
Track software like this
Free during beta