What is CVE-2022-27004?

CVE-2022-27004 is a command injection vulnerability in Totolink routers X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 via the remote6in4 parameter.

How severe is CVE-2022-27004?

CVE-2022-27004 has a severity rating of 9.8 (critical).

How can an attacker exploit CVE-2022-27004?

Attackers can exploit CVE-2022-27004 by crafting a request with malicious commands and executing them via the remote6in4 parameter.

Is there a fix available for CVE-2022-27004?

At the moment, there is no official fix available for CVE-2022-27004. It is recommended to monitor the Totolink website or contact their support for updates.

Vulnerability/
CVE-2022-27004

critical

9.8

CWE

78 77

15/3/2022

12/9/2024

CVE-2022-27004: OS Command Injection

First published: Tue Mar 15 2022(Updated: )

Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6in4 function via the remote6in4 parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

Credit: cve@mitre.org cve@mitre.org

Affected Software	Affected Version	How to fix
Totolink X5000r Firmware	=9.1.0u.6118_b20201102
TOTOLINK X5000R
Totolink A7000r Firmware	=9.1.0u.6115_b20201022
TOTOLINK A7000R
All of
Totolink X5000r Firmware	=9.1.0u.6118_b20201102
TOTOLINK X5000R
All of
Totolink A7000r Firmware	=9.1.0u.6115_b20201022
TOTOLINK A7000R

Never miss a vulnerability like this again

Reference Links

https://github.com/wudipjq/my_vuln/blob/main/totolink/vuln_31/31.md

Frequently Asked Questions

What is CVE-2022-27004?
CVE-2022-27004 is a command injection vulnerability in Totolink routers X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 via the remote6in4 parameter.
How severe is CVE-2022-27004?
CVE-2022-27004 has a severity rating of 9.8 (critical).
Which Totolink router firmware versions are affected?
Totolink routers X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 are affected.
How can an attacker exploit CVE-2022-27004?
Attackers can exploit CVE-2022-27004 by crafting a request with malicious commands and executing them via the remote6in4 parameter.
Is there a fix available for CVE-2022-27004?
At the moment, there is no official fix available for CVE-2022-27004. It is recommended to monitor the Totolink website or contact their support for updates.

collector/nvd-index
agent/weakness
agent/type
agent/author
agent/softwarecombine
agent/severity
agent/references
agent/tags
agent/description
agent/first-publish-date
agent/event
collector/mitre-cve
source/MITRE
agent/last-modified-date
collector/nvd-api
source/NVD
agent/software-canonical-lookup
vendor/totolink
canonical/totolink x5000r firmware
version/totolink x5000r firmware/9.1.0u.6118_b20201102
canonical/totolink x5000r
canonical/totolink a7000r firmware
version/totolink a7000r firmware/9.1.0u.6115_b20201022
canonical/totolink a7000r

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.