CVE-2022-27005: OS Command Injection
Totolink routers s X5000R V9.1.0u.6118B20201102 and A7000R V9.1.0u.6115B20201022 were discovered to contain a command injection vulnerability in the setWanCfg function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-27005?
CVE-2022-27005 is a command injection vulnerability in Totolink routers X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022.
How severe is CVE-2022-27005?
CVE-2022-27005 has a severity score of 9.8 (critical).
What is the affected software for CVE-2022-27005?
The affected software for CVE-2022-27005 is Totolink X5000r Firmware version 9.1.0u.6118_b20201102 and Totolink A7000r Firmware version 9.1.0u.6115_b20201022.
How can attackers exploit CVE-2022-27005?
Attackers can exploit CVE-2022-27005 by executing arbitrary commands via a crafted request to the setWanCfg function using the hostName parameter.
Is there a fix available for CVE-2022-27005?
A fix for CVE-2022-27005 is not currently available. It is recommended to update to a patched version when it becomes available.