PT-2022-23408 · Totolink · Totolink N350Rt

Published 2022-08-25 · Updated 2023-08-08 · CVE-2022-36486

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK N350RT version 9.3.5u.6139 B20201216

Description A command injection issue was found via the FileName parameter in the UploadFirmwareFile function.

Recommendations For version 9.3.5u.6139 B20201216, consider restricting access to the UploadFirmwareFile function until a patch is available to prevent potential command injection attacks. Avoid using the FileName parameter in the affected function to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-36486

Affected Products

Totolink N350Rt

References · 3

• 🔥 https://github.com/Darry-lang1/vuln/tree/main/TOTOLINK/N350RT/4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-36486 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36486 · Vendor Advisory