PT-2022-27151 · Totolink · Totolink Nr1800X

Published 2022-11-23 · Updated 2023-08-08 · CVE-2022-44252

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK NR1800X version 9.1.0u.6279 B20210910

Description The issue concerns a command injection via the FileName parameter in the setUploadSetting function. This allows for potential malicious commands to be executed. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For TOTOLINK NR1800X version 9.1.0u.6279 B20210910, consider disabling the setUploadSetting function until a patch is available to prevent exploitation via the FileName parameter. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-44252

Affected Products

Totolink Nr1800X

References · 5

• 🔥 https://brief-nymphea-813.notion.site/LR350-command-injection-setUploadSetting-b6d3012a3c2f43adac79c44edd57c937 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-44252 · Security Note
• https://osv.dev/vulnerability/CVE-2022-44252 · Vendor Advisory
• https://t.me/cvenotify/38530 · Telegram Post
• https://t.me/cibsecurity/53430 · Telegram Post