Command Injection Vulnerability in TOTOLINK Routers
CVE-2022-25131

9.8CRITICAL

Key Information:

Vendor
Totolink
Status
T6 Firmware
Vendor
CVE Published:
19 February 2022

Summary

A command injection vulnerability exists in the recvSlaveCloudCheckStatus function of TOTOLINK Technology routers. This flaw allows an attacker to execute arbitrary commands on the affected devices by sending a specially crafted MQTT packet. This could lead to unauthorized access and manipulation of the router's functionality, posing significant security risks to users.

References

https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vu...
x_refsource_MISC

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.