Command Injection Vulnerability in TOTOLINK A3700R Router
CVE-2022-36460

7.8HIGH

Key Information:

Vendor

Totolink
Status
A3700r Firmware
Vendor
CVE Published:
25 August 2022

What is CVE-2022-36460?

The TOTOLINK A3700R router firmware version V9.1.2u.6134_B20201202 is vulnerable to a command injection flaw due to improper handling of input parameters. Specifically, the vulnerability is exploited through the FileName parameter in the UploadFirmwareFile function, allowing attackers to execute arbitrary commands on the affected device. This type of vulnerability can lead to unauthorized access and compromise the integrity of the router and the network it operates within.

References

https://github.com/Darry-lang1/vuln/blob/main/TOTOLINK/A3...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.