CVE-2022-25078: OS Command Injection
Published Feb 22, 2022
·Updated
TOTOLink A3600R V4.1.2cu.5182B20201102 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERYSTRING parameter.
Affected Software
2 affected components
TOTOLINK A3600r Firmware=4.1.2cu.5182_b20201102
TOTOLINK A3600r Firmware
Remediation
Event History
Feb 22, 2022
CVE Published
via MITRE·10:44 PM
Data Sourced
via MITRE·10:44 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this TOTOLink A3600R vulnerability?
The vulnerability ID for this TOTOLink A3600R vulnerability is CVE-2022-25078.
2
What is the severity of CVE-2022-25078?
The severity of CVE-2022-25078 is critical with a CVSS score of 9.8.
3
What is the affected software version of CVE-2022-25078?
The affected software version of CVE-2022-25078 is Totolink A3600R Firmware 4.1.2cu.5182_B20201102.
4
How can attackers exploit CVE-2022-25078?
Attackers can exploit CVE-2022-25078 by executing arbitrary commands via the QUERY_STRING parameter.
5
Is there a fix available for CVE-2022-25078?
Please refer to the given reference link for details on how to fix CVE-2022-25078.