CVE-2022-26210: OS Command Injection
Totolink A830R V5.9c.4729B20191112, A3100R V4.1.2cu.5050B20200504, A950RG V4.1.2cu.5161B20200903, A800R V4.1.2cu.5137B20200730, A3000RU V5.9c.5185B20201128, and A810R V4.1.2cu.5182B20201026 were discovered to contain a command injection vulnerability in the function setUpgradeFW, via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-26210?
CVE-2022-26210 is a command injection vulnerability found in Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026.
How severe is CVE-2022-26210?
CVE-2022-26210 has a severity rating of 9.8 (Critical).
Which software versions are affected by CVE-2022-26210?
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 are affected by CVE-2022-26210.
How can I fix CVE-2022-26210?
Currently, there is no official fix or patch available for CVE-2022-26210. It is recommended to monitor the Totolink website or contact their support for updates on addressing this vulnerability.
Where can I find more information about CVE-2022-26210?
More information about CVE-2022-26210 can be found at the following link: [https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_23/23.md](https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_23/23.md)