CVE-2025-45798 is a critical command injection (CVSS 9.8) in TOTOLINK A950RG firmware V4.1.2cu.5204_B20210112. The weak spot is the IpTo parameter handled by setNoticeCfg. The record lists no fixed firmware, so isolate the router's web management interface, check TOTOLINK's download page for newer firmware, and replace unsupported units.
What's affected
The NVD record names one product line: TOTOLINK A950RG, firmware V4.1.2cu.5204_B20210112. The vulnerable function is setNoticeCfg, and the field involved is IpTo. The record is a short report derived from a public write-up on GitHub rather than a vendor advisory.
No fixed firmware version is stated. Do not assume that a later firmware fixes it unless TOTOLINK's release notes say so.
How to check if you're exposed
Routers do not show up in package manager queries, so check the device itself.
- Log in to the router's management page and read the firmware version on the status or system page. Compare it with V4.1.2cu.5204_B20210112.
- Confirm the exact model name on the label. The record covers A950RG only, not other TOTOLINK models.
- Test whether the management interface answers from the internet side. If you can reach it from outside your network, so can anyone else.
- Review any port forwarding, UPnP or remote administration settings that expose the web interface.
If the router is part of a product you ship or manage for others, record the firmware version in your asset inventory so the next advisory is quick to triage.
What to do now
- Identify every TOTOLINK A950RG on your network and read its firmware version.
- Turn off remote (WAN side) administration and any port forwarding to the management interface.
- Restrict management access to one trusted wired host or VLAN and change the admin password from any default.
- Check TOTOLINK's download page for firmware newer than V4.1.2cu.5204_B20210112, read its notes, and install it only from the vendor site.
- If no update exists for your hardware, plan to replace the router, especially where it sits at the edge of a business network.
- Watch the router for unexpected reboots or configuration changes, which can point to attempts against the management service.
Why it matters
The record lists CWE-77 (Command Injection). The IpTo value from the request is used to build a command that the device runs, and special characters in it are not neutralised. On a router that usually means the command runs with high privileges on the device itself.
A flaw like this matters more on edge devices than on desktop software. The router sits between your network and the internet, it rarely gets patched, and it often has no logging you can read. The vector (AV:N, AC:L, PR:N, UI:N) is the worst case for reach. The record does not mark the CVE as exploited in the wild, and it is not on the CISA KEV list.
Quick check
Is there a firmware fix?
The NVD record does not name one. Check the TOTOLINK download page for your exact model and read the release notes before you rely on a newer version.
What is the quickest mitigation?
Make sure the management interface is not reachable from the internet and limit it to one trusted host on the local network.
Sources
Last reviewed: 18 October 2026.
