TOTOLINK A950RG pre-auth command injection via UploadCustomModule FileMd5 parameter

#!/usr/bin/env bash
# check_totolink_a950rg.sh — CVE-2026-114575 detection
# Checks if a target IP hosts a TOTOLINK A950RG with vulnerable firmware.
# Usage: bash check_totolink_a950rg.sh <ROUTER_IP>
# Exit codes: 0 = VULNERABLE, 1 = PATCHED/not-affected, 2 = UNKNOWN

set -euo pipefail

if [[ $# -lt 1 ]]; then
  echo "Usage: $0 <ROUTER_IP>"
  exit 2
fi

TARGET="$1"
TIMEOUT=5
VULN_FW="4.1.2cu.5268_B20221104"

# Step 1: Check if the web interface is reachable
HTTP_RESP=$(curl -sk --max-time "$TIMEOUT" -o /dev/null -w "%{http_code}" "http://${TARGET}/" 2>/dev/null || true)

if [[ -z "$HTTP_RESP" || "$HTTP_RESP" == "000" ]]; then
  echo "UNKNOWN — Cannot reach http://${TARGET}/ (timeout or connection refused)"
  exit 2
fi

# Step 2: Fetch the page content and look for TOTOLINK A950RG identifiers
PAGE=$(curl -sk --max-time "$TIMEOUT" "http://${TARGET}/" 2>/dev/null || true)

if ! echo "$PAGE" | grep -qi "totolink\|A950RG"; then
  echo "UNKNOWN — Host at ${TARGET} does not appear to be a TOTOLINK device"
  exit 2
fi

if ! echo "$PAGE" | grep -qi "A950RG"; then
  echo "UNKNOWN — TOTOLINK device detected but model is not A950RG"
  exit 2
fi

# Step 3: Try to extract firmware version from the page or device info endpoint
DEVINFO=$(curl -sk --max-time "$TIMEOUT" \
  -X POST "http://${TARGET}/cgi-bin/cstecgi.cgi" \
  -H "Content-Type: application/json" \
  -d '{"topicurl":"setting/getDeviceInfo"}' 2>/dev/null || true)

FW_VERSION=""
if echo "$DEVINFO" | grep -qoP '"firmwareVer"\s*:\s*"[^"]+"'; then
  FW_VERSION=$(echo "$DEVINFO" | grep -oP '"firmwareVer"\s*:\s*"\K[^"]+' || true)
fi

# Fallback: check page source for firmware string
if [[ -z "$FW_VERSION" ]]; then
  FW_VERSION=$(echo "$PAGE" | grep -oP '4\.1\.2cu\.[0-9]+_B[0-9]+' | head -1 || true)
fi

if [[ -z "$FW_VERSION" ]]; then
  echo "UNKNOWN — TOTOLINK A950RG detected at ${TARGET} but firmware version could not be determined"
  echo "  Manually verify firmware via admin panel. Vulnerable version: ${VULN_FW}"
  exit 2
fi

echo "Detected firmware: ${FW_VERSION}"

if [[ "$FW_VERSION" == "$VULN_FW" ]]; then
  echo "VULNERABLE — TOTOLINK A950RG at ${TARGET} runs firmware ${VULN_FW} (CVE-2026-114575)"
  echo "  Action: Replace this device with a managed enterprise AP/router immediately."
  exit 0
else
  echo "PATCHED — TOTOLINK A950RG at ${TARGET} runs firmware ${FW_VERSION} (not the known-vulnerable build)"
  echo "  Note: No vendor patch exists for CVE-2026-114575. If this is a different build, verify independently."
  exit 1
fi