PT-2022-3856 · Totolink · Totolink A810R

Published 2022-02-22 · Updated 2023-08-08 · CVE-2022-25079

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLink A810R version 4.1.2cu.5182 B20201026

Description The issue is related to a command injection vulnerability in the "Main" function of the TOTOLink A810R router's firmware. This vulnerability is caused by the lack of input data sanitization. It allows remote attackers to execute arbitrary commands via the QUERY STRING parameter.

Recommendations For TOTOLink A810R version 4.1.2cu.5182 B20201026, as a temporary workaround, consider restricting access to the "Main" function until a patch is available. Avoid using the QUERY STRING parameter in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2022-04658

CVE-2022-25079

Affected Products

Totolink A810R

References · 5

• 🔥❌ https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A810R/README.md · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2022-25079 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04658 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-25079 · Security Note
• https://t.me/cibsecurity/37994 · Telegram Post