TOTOLINK A950RG firewall.so apmib_set command injection

Summary

A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function apmib_set of the file firewall.so. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

Remediation

1. Inventory every TOTOLINK A950RG deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Advisoryhttps://vuldb.com/cve/CVE-2026-116506
• Advisoryhttps://vuldb.com/submit/1022555
• Referencehttps://gist.github.com/H3rmesk1t/1046036a8601e93f375754e11307bfc8
• Referencehttps://vuldb.com/vuln/426404
• Referencehttps://vuldb.com/vuln/426404/cti
• Referencehttps://www.totolink.net/