PT-2022-18181 · Totolink · Totolink A7000R+1

Published 2022-03-15 · Updated 2024-09-12 · CVE-2022-27005

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Totolink routers X5000R version 9.1.0u.6118 B20201102 Totolink routers A7000R version 9.1.0u.6115 B20201022

Description A command injection issue was discovered in the setWanCfg function via the hostName parameter, allowing attackers to execute arbitrary commands via a crafted request.

Recommendations For Totolink routers X5000R version 9.1.0u.6118 B20201102, consider disabling the setWanCfg function until a patch is available. For Totolink routers A7000R version 9.1.0u.6115 B20201022, avoid using the hostName parameter in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-27005

Affected Products

Totolink A7000R

Totolink X5000R

References · 4

• 🔥❌ https://github.com/wudipjq/my_vuln/blob/main/totolink/vuln_30/30.md · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2022-27005 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27005 · Security Note
• https://t.me/cvenotify/94329 · Telegram Post