CVE-2021-44247: Command Injection
Totolink devices A3100R v4.1.2cu.5050B20200504, A830R v5.9c.4729B20191112, and A720R v4.1.5cu.470B20200911 were discovered to contain command injection vulnerability in the function setNoticeCfg. This vulnerability allows attackers to execute arbitrary commands via the IpFrom parameter.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-44247?
CVE-2021-44247 is a command injection vulnerability found in Totolink devices A3100R v4.1.2cu.5050_B20200504, A830R v5.9c.4729_B20191112, and A720R v4.1.5cu.470_B20200911.
How severe is CVE-2021-44247?
CVE-2021-44247 has a severity rating of 9.8 (Critical).
Which software versions of Totolink devices are affected by CVE-2021-44247?
Totolink A3100r Firmware version 4.1.2cu.5050_b20200504, Totolink A830r Firmware version 5.9c.4729_b20191112, and Totolink A720r Firmware version 4.1.5cu.470_b20200911 are affected by CVE-2021-44247.
How can an attacker exploit CVE-2021-44247?
An attacker can exploit CVE-2021-44247 by sending a specially crafted IpFrom parameter, allowing them to execute arbitrary commands on the vulnerable Totolink devices.
Is there a fix available for CVE-2021-44247?
At the moment, there is no information regarding an official fix for CVE-2021-44247. It is recommended to follow the vendor's security advisories for updates.