PT-2022-23793 · Totolink · Totolink A7000R

Published 2022-08-25 · Updated 2023-08-08 · CVE-2022-37079

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK A7000R version 9.1.0u.6115 B20201022

Description A command injection issue was found via the hostName parameter in the setOpModeCfg function, allowing for potential exploitation.

Recommendations For version 9.1.0u.6115 B20201022, avoid using the hostName parameter in the setOpModeCfg function until a fix is available. Consider restricting access to this function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-37079

Affected Products

Totolink A7000R

References · 3

• 🔥 https://github.com/Darry-lang1/vuln/tree/main/TOTOLINK/A7000R/5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-37079 · Security Note
• https://osv.dev/vulnerability/CVE-2022-37079 · Vendor Advisory