PT-2022-12375 · Totolink · Totolink X5000R

Published 2022-02-04 · Updated 2022-02-04 · CVE-2021-45733

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TOTOLINK X5000R version 9.1.0u.6118 B20201102

Description A command injection issue was found in the NTPSyncWithHost function, allowing attackers to execute arbitrary commands via the host time parameter.

Recommendations For TOTOLINK X5000R version 9.1.0u.6118 B20201102, consider disabling the NTPSyncWithHost function until a patch is available to prevent exploitation. Restrict access to the host time parameter in the affected function to minimize the risk of command injection attacks.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2021-45733

Affected Products

Totolink X5000R

References · 5

• 🔥❌ https://github.com/pjqwudi/my_vuln/blob/main/totolink/vuln_7/7.md · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2021-45733 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45733 · Security Note
• https://t.me/cibsecurity/36813 · Telegram Post
• https://t.me/cvenotify/26258 · Telegram Post