PT-2022-3854 · Totolink · Totolink A800R+5

Published

2022-03-15

·

Updated

2025-04-23

·

CVE-2022-26210

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions TOTOLINK A800R version 4.1.2cu.5137 B20200730 TOTOLINK A810R version 4.1.2cu.5182 B20201026 TOTOLINK A830R version 5.9c.4729 B20191112 TOTOLINK A3000RU version 5.9c.5185 B20201128 TOTOLINK A3100R version 4.1.2cu.5050 B20200504 TOTOLINK A950RG version 4.1.2cu.5161 B20200903
Description The issue is related to the setUpgradeFW function in the firmware of TOTOLINK routers, which lacks input validation for the FileName parameter. This allows a remote attacker to execute arbitrary commands via a crafted request.
Recommendations For TOTOLINK A800R version 4.1.2cu.5137 B20200730, consider disabling the setUpgradeFW function until a patch is available. For TOTOLINK A810R version 4.1.2cu.5182 B20201026, restrict access to the setUpgradeFW function to minimize the risk of exploitation. For TOTOLINK A830R version 5.9c.4729 B20191112, avoid using the FileName parameter in the affected function until the issue is resolved. For TOTOLINK A3000RU version 5.9c.5185 B20201128, apply configuration changes to limit the impact of the vulnerability. For TOTOLINK A3100R version 4.1.2cu.5050 B20200504, consider implementing additional security measures to prevent command injection attacks. For TOTOLINK A950RG version 4.1.2cu.5161 B20200903, temporarily disable the setUpgradeFW function to prevent exploitation.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78CWE-77

Related Identifiers

BDU:2022-04656
CVE-2022-26210

Affected Products

Totolink A3000Ru
Totolink A3100R
Totolink A800R
Totolink A810R
Totolink A830R
Totolink A950Rg