Command Injection Vulnerability in TOTOLink N600R Router

CVE-2022-28913

Summary

The TOTOLink N600R router is susceptible to a command injection vulnerability through the filename parameter in the /setting/setUploadSetting endpoint. This issue allows attackers to execute arbitrary commands on the device, potentially leading to unauthorized access and manipulation of the router's settings. Users are advised to apply any available patches from the vendor to mitigate this security risk.

References