CVE-2022-27003: OS Command Injection
Totolink routers s X5000R V9.1.0u.6118B20201102 and A7000R V9.1.0u.6115B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6rd function via the relay6rd parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-27003.
What is the title of the vulnerability?
The title of the vulnerability is 'Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 Command Injection Vulnerability in Tunnel 6rd Function.'
What is the severity of CVE-2022-27003?
The severity of CVE-2022-27003 is critical with a score of 9.8.
How can an attacker exploit CVE-2022-27003?
An attacker can exploit CVE-2022-27003 by sending a crafted request containing arbitrary commands via the relay6rd parameter in the Tunnel 6rd function of Totolink routers X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022.
Is there a fix available for CVE-2022-27003?
At the moment, there is no fix available for CVE-2022-27003. It is recommended to stay updated with the latest security patches and follow the advisories from the vendor.