CVE-2022-25077: OS Command Injection

Published Feb 22, 2022

Updated

TOTOLink A3100R V4.1.2cu.5050B20200504 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERYSTRING parameter.

Affected Software

2 affected components

TOTOLINK A3100r Firmware=4.1.2cu.5050_b20200504

TOTOLINK A3100R

Remediation

Patch Available

https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A3100R/README.md

Event History

Feb 22, 2022

CVE Published

via MITRE·10:44 PM

Data Sourced

via MITRE·10:44 PM

Description

Frequently Asked Questions

What is the vulnerability ID of TOTOLink A3100R V4.1.2cu.5050_B20200504?

The vulnerability ID of TOTOLink A3100R V4.1.2cu.5050_B20200504 is CVE-2022-25077.

What is the severity of CVE-2022-25077?

The severity of CVE-2022-25077 is critical with a score of 9.8.

How does the command injection vulnerability in TOTOLink A3100R V4.1.2cu.5050_B20200504 work?

The command injection vulnerability in TOTOLink A3100R V4.1.2cu.5050_B20200504 allows attackers to execute arbitrary commands by exploiting the "Main" function through the QUERY_STRING parameter.

Is TOTOLink A3100R V4.1.2cu.5050_B20200504 the only affected software version?

Yes, TOTOLink A3100R V4.1.2cu.5050_B20200504 is the only affected software version.

How can I fix the command injection vulnerability in TOTOLink A3100R V4.1.2cu.5050_B20200504?

To fix the command injection vulnerability, it is recommended to update the Totolink A3100r Firmware to a version that is not vulnerable.