CVE-2026-116506

CRITICAL 9.9

TOTOLINK A950RG firewall.so apmib_set command injection

CVSS Score

9.9

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function apmib_set of the file firewall.so. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CWE	CWE-77 CWE-74
Vendor	totolink
Product	a950rg
Published	Oct 26, 2026

Stay Ahead of the Next One

Get instant alerts for totolink a950rg

Be the first to know when new critical vulnerabilities affecting totolink a950rg are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

TOTOLINK / A950RG

4.1.2cu.5268_B20221104

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/426404 vuldb.com: https://vuldb.com/vuln/426404/cti vuldb.com: https://vuldb.com/cve/CVE-2026-116506 vuldb.com: https://vuldb.com/submit/1022555 gist.github.com: https://gist.github.com/H3rmesk1t/1046036a8601e93f375754e11307bfc8 totolink.net: https://www.totolink.net/

Credits

🔍 LiuYijun_JX.SGCC (VulDB User)