CVE-2021-45738: Command Injection
Published Feb 4, 2022
·Updated
TOTOLINK X5000R v9.1.0u.6118B20201102 was discovered to contain a command injection vulnerability in the function UploadFirmwareFile. This vulnerability allows attackers to execute arbitrary commands via the parameter FileName.
Affected Software
2 affected components
TOTOLINK X5000r Firmware=9.1.0u.6118_b20201102
TOTOLINK X5000R
Event History
Feb 4, 2022
CVE Published
via MITRE·01:33 AM
Data Sourced
via MITRE·01:33 AM
Description
Frequently Asked Questions
1
What is CVE-2021-45738?
CVE-2021-45738 is a command injection vulnerability discovered in TOTOLINK X5000R v9.1.0u.6118_B20201102.
2
How does the command injection vulnerability in TOTOLINK X5000R v9.1.0u.6118_B20201102 work?
The command injection vulnerability in TOTOLINK X5000R v9.1.0u.6118_B20201102 allows attackers to execute arbitrary commands by exploiting the UploadFirmwareFile function and the FileName parameter.
3
What is the severity of CVE-2021-45738?
The severity of CVE-2021-45738 is critical with a CVSS score of 9.8.
4
What software versions are affected by CVE-2021-45738?
TOTOLINK X5000R v9.1.0u.6118_B20201102 is affected by CVE-2021-45738.
5
How can I fix the command injection vulnerability in TOTOLINK X5000R v9.1.0u.6118_B20201102?
Patch or update the TOTOLINK X5000R firmware to a non-vulnerable version.