Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2026-116506: TOTOLINK A950RG router allows remote command injection
CVE-2026-116506 · published 1 day ago
Summary
The router’s firewall component can be tricked into running unauthorized commands when an attacker sends specially crafted data. Because the flaw can be exploited over the network, an attacker could gain control of the device without physical access. Update the router firmware to the latest version or apply the vendor’s patch as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| totolink | a950rg | 4.1.2cu.5268_B20221104 |
Original advisory text
TOTOLINK A950RG firewall.so apmib_set command injection
A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function apmib_set of the file firewall.so. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
8.6
High
Type
CWE-77Command Injection
CWE-74Injection
Timeline
Published26 Oct 2026
Updated27 Oct 2026
First seen26 Oct 2026
Track software like this
Free during beta