CVE-2026-114575: Command Injection in TOTOLINK A950RG

This vulnerability affects TOTOLINK A950RG version 4.1.2cu.5268_B20221104. The UploadCustomModule function in lib/cste_modules/product.so improperly handles the FileMd5 argument, enabling remote command injection. The vulnerability has a CVSS 4.0 base score of 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, and security requirements. Exploit code is publicly available, but no confirmed active exploitation in the wild has been reported.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device without authentication, potentially leading to full system compromise, data theft, or disruption of service. Given the critical CVSS score and remote attack vector, this vulnerability poses a severe risk to affected devices.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict network access to the affected device and monitor for suspicious activity related to the UploadCustomModule function.