Command Injection Vulnerability in Totolink Routers

CVE-2022-26210

Summary

Certain models of Totolink routers, including the A830R, A3100R, A950RG, A800R, A3000RU, and A810R, are susceptible to a command injection vulnerability via the setUpgradeFW function. By exploiting the vulnerability through a specially crafted request targeting the FileName parameter, attackers can execute arbitrary commands on the affected devices, potentially compromising network security. It is critical for users of these routers to implement immediate patches and monitor for unusual activity to protect their systems.

References