CVE-2022-27004: OS Command Injection
Totolink routers s X5000R V9.1.0u.6118B20201102 and A7000R V9.1.0u.6115B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6in4 function via the remote6in4 parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-27004?
CVE-2022-27004 is a command injection vulnerability in Totolink routers X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 via the remote6in4 parameter.
How severe is CVE-2022-27004?
CVE-2022-27004 has a severity rating of 9.8 (critical).
Which Totolink router firmware versions are affected?
Totolink routers X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 are affected.
How can an attacker exploit CVE-2022-27004?
Attackers can exploit CVE-2022-27004 by crafting a request with malicious commands and executing them via the remote6in4 parameter.
Is there a fix available for CVE-2022-27004?
At the moment, there is no official fix available for CVE-2022-27004. It is recommended to monitor the Totolink website or contact their support for updates.