PT-2022-3893 · Totolink · Totolink T6

Published 2022-02-22 · Updated 2023-08-08 · CVE-2022-25084

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TOTOLink T6 version V5.9c.4085 B20190428

Description The issue is related to the lack of input data sanitization in the "Main" function of the TOTOLink T6 mesh system's firmware. This allows a remote attacker to execute arbitrary commands through the QUERY STRING parameter.

Recommendations For TOTOLink T6 version V5.9c.4085 B20190428, consider disabling the "Main" function until a patch is available to prevent exploitation via the QUERY STRING parameter. Restrict access to the vulnerable function to minimize the risk of arbitrary command execution. Avoid using the QUERY STRING parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2022-04703

CVE-2022-25084

Affected Products

Totolink T6

References · 6

• 🔥❌ https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/T6/README.md · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2022-25084 · Security Note
• https://bdu.fstec.ru/vul/2022-04703 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25084 · Vendor Advisory
• https://t.me/cibsecurity/37991 · Telegram Post
• https://t.me/cvenotify/27703 · Telegram Post