External risk intelligence

TOTOLINK A950RG Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-114575

The affected product is a router/network gateway device. Such devices are designed to be internet-facing by default to provide network connectivity, often exposing administrative or management interfaces to the network. Command injection vulnerabilities in these types of edge appliances are typically reachable via the public internet.

Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in TOTOLINK routers. This issue, stemming from a flaw in how the device handles a specific function, allows for remote command injection, meaning an attacker could potentially execute commands on the device without needing any prior access. The exploit for this vulnerability has been published.

Attackers can remotely inject commands into the router.
Routers are critical internet-facing devices.
Confirm if your TOTOLINK routers are affected and exposed.

Attack Path

How an attacker could exploit the issue

An attacker can remotely reach the vulnerable device, likely through its network interface. Once access is gained, the attacker can target the `UploadCustomModule` function within the `product.so` library. By manipulating the `FileMd5` argument, the attacker can inject and execute arbitrary commands on the system.

Remote network access is required.
Manipulating the `FileMd5` argument triggers the flaw.
Leads to command injection with severe consequences.

Live Threat

Current exploitation, exposure, and threat context

A command injection vulnerability in a router's custom module upload function could allow an unauthenticated remote attacker to execute arbitrary commands on the device. This could affect the router's service behavior and potentially sensitive information if the commands executed grant access to such data.

Router system integrity.
Remote command execution.
Compromise of network traffic.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects TOTOLINK routers, placing responsibility on network or infrastructure teams for initial identification and on platform or application owners for remediation. The immediate first step is to locate all instances of the affected device, determine their exposure, and confirm business criticality to prioritize actions.

Identify affected devices and owners.
Verify network reachability and criticality.
Plan remediation with vendor support.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the TOTOLINK A950RG?

The TOTOLINK A950RG is a wireless router typically used to manage home or small office network connectivity. It serves as a gateway between local devices and the internet, routing traffic and providing essential network services. This specific device acts as the edge of a network, making it a critical component for traffic flow and internet access.

What does command injection mean for CVE-2026-114575?

Command injection is a vulnerability where an application fails to properly sanitize user input, allowing an attacker to run their own operating system commands. In the case of CVE-2026-114575, this involves the CWE-77 and CWE-74 weakness classes. Because the router executes these injected commands with its own system privileges, the attacker effectively gains control over the device's functions and internal processes.

How is this command injection triggered?

The flaw resides in the UploadCustomModule function within the router's product.so library. An attacker triggers the bug by sending a specially crafted request that manipulates the FileMd5 argument. Simply communicating with the router's standard network services is not enough; the attacker must specifically target this custom module upload process with the malicious argument to achieve execution.

Is my TOTOLINK A950RG router at risk?

Halo Surface Signal indicates that routers like the A950RG are often designed to be internet-facing to function as network gateways, which can expose their management interfaces to the public internet. If your device is configured to be accessible from the outside, it is at higher risk. You should determine if your specific instance is reachable over the network, as devices exposed to the internet are more easily targeted by this remote vulnerability.

How do I respond to this vulnerability?

The first step is to locate all TOTOLINK A950RG devices within your network and confirm their specific firmware version. Once identified, evaluate whether these devices are exposed to the internet or restricted to internal traffic. After assessing your environment, prioritize these assets for remediation and consult the manufacturer for official security updates or guidance on disabling the vulnerable module functionality until a fix is applied.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.