CVE-2022-25082: OS Command Injection

Published Feb 22, 2022

Updated

TOTOLink A950RG V5.9c.4050B20190424 and V4.1.2cu.5204B20210112 were discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERYSTRING parameter.

Affected Software

3 affected components

TOTOLINK A950rg Firmware=4.1.2cu.5204_b20210112

TOTOLINK A950rg Firmware=5.9c.4050_b20190424

TOTOLINK A950RG

Remediation

Patch Available

https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A950RG/README.md

Event History

Feb 22, 2022

CVE Published

via MITRE·10:44 PM

Data Sourced

via MITRE·10:44 PM

Description

Frequently Asked Questions

What is CVE-2022-25082?

CVE-2022-25082 is a command injection vulnerability found in TOTOLink A950RG routers.

How severe is CVE-2022-25082?

CVE-2022-25082 has a severity rating of 9.8 out of 10, making it critical.

Which versions of TOTOLink A950RG are affected by CVE-2022-25082?

TOTOLink A950RG V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 are affected by CVE-2022-25082.

How can an attacker exploit CVE-2022-25082?

An attacker can exploit CVE-2022-25082 by sending a malicious QUERY_STRING parameter, allowing them to execute arbitrary commands.

Is there a fix available for CVE-2022-25082?

At the time of writing, there is no known fix available for CVE-2022-25082. It is recommended to keep your router firmware up to date and implement any security patches provided by the vendor.