PT-2022-17727 · Totolink · Totolink X5000R

Published 2022-03-15 · Updated 2023-08-08 · CVE-2022-26213

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Totolink X5000R Firmware version 9.1.0u.6118 B20201102

Description The issue is related to a command injection vulnerability in the setNtpCfg function, specifically via the tz parameters. This allows attackers to execute arbitrary commands by sending a crafted request.

Recommendations For Totolink X5000R Firmware version 9.1.0u.6118 B20201102, consider disabling the setNtpCfg function until a patch is available to prevent exploitation. Restrict access to the tz parameters in the affected function to minimize the risk of command injection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-26213

Affected Products

Totolink X5000R

References · 4

• 🔥❌ https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_21/21.md · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2022-26213 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26213 · Security Note
• https://t.me/cibsecurity/38989 · Telegram Post