PT-2022-12499 · Totolink · Totolink A3100R

Kv · Published 2022-03-30 · Updated 2022-04-05 · CVE-2021-46007

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions totolink a3100r version V5.9c.4577

Description The issue concerns an os command injection vulnerability. It occurs because the backend of a page executes the ping command, and the input field does not properly filter special symbols, leading to potential command injection attacks.

Recommendations For totolink a3100r version V5.9c.4577, consider restricting access to the vulnerable page or input field until a proper fix is available. As a temporary workaround, avoid using special symbols in the input field to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-46007

Affected Products

Totolink A3100R

References · 6

• 🔥 https://hackmd.io/t_nRWxS2Q2O7GV2E5BhQMg · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-46007 · Security Note
• https://osv.dev/vulnerability/CVE-2021-46007 · Vendor Advisory
• http://totolink.com · Vendor Advisory
• https://t.me/cibsecurity/39894 · Telegram Post
• http://a3100r.com · Note