What is CVE-2026-116504?

CVE-2026-116504 is a critical-severity vulnerability in Totolink A950rg, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 9.9/10. Published 2026-10-26.

How severe is CVE-2026-116504?

Critical severity. CVSS v3 base score is 9.9 out of 10.

RCE in Totolink A950rg

CVE-2026-116504

A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Published 2026-10-26.

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Totolink A950rg — versions 4.1.2cu.5268_B20221104

Weakness classification (CWE)

References

vuldb.com/vuln/426402 (technical-description, vdb-entry)
vuldb.com/vuln/426402/cti (signature, permissions-required)
vuldb.com/cve/CVE-2026-116504 (third-party-advisory)
vuldb.com/submit/1022553 (third-party-advisory)
gist.github.com/H3rmesk1t/c2f2dcfdb6238a7ddb8fb0622ad52948 (exploit)
www.totolink.net/ (product)

Frequently asked questions

What is CVE-2026-116504?: CVE-2026-116504 is a critical-severity vulnerability in Totolink A950rg, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 9.9/10. Published 2026-10-26.
How severe is CVE-2026-116504?: Critical severity. CVSS v3 base score is 9.9 out of 10.