CVE-2026-116504

CRITICAL 9.9CVE-2026-116504 · Published 26/10/2026 · updated 27/10/2026

In short

CVE-2026-116504 is a CRITICAL (CVSS 9.9) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 75.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

References

gist.github.com/H3rmesk1t/c2f2dcfdb6238a7ddb8fb0622ad52948
vuldb.com/cve/CVE-2026-116504
vuldb.com/submit/1022553
vuldb.com/vuln/426402
vuldb.com/vuln/426402/cti
totolink.net

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free