CVE-2022-28581: OS Command Injection

Published May 5, 2022

Updated

It is found that there is a command injection vulnerability in the setWiFiAdvancedCfg interface in TOTOlink A7100RU (v7.4cu.2313b20191024) router, which allows an attacker to execute arbitrary commands through a carefully constructed payload.

Affected Software

2 affected components

TOTOLINK A7100ru Firmware=7.4cu.2313_b20191024

TOTOLINK A7100RU

Event History

May 5, 2022

CVE Published

via MITRE·05:42 PM

Data Sourced

via MITRE·05:42 PM

Description

Frequently Asked Questions

What is CVE-2022-28581?

CVE-2022-28581 is a command injection vulnerability in the setWiFiAdvancedCfg interface in TOTOlink A7100RU router.

How severe is CVE-2022-28581?

CVE-2022-28581 has a severity rating of 9.8, which is classified as critical.

How can an attacker exploit CVE-2022-28581?

An attacker can exploit CVE-2022-28581 by sending a carefully constructed payload through the setWiFiAdvancedCfg interface to execute arbitrary commands on the affected router.

Is TOTOlink A7100RU firmware version 7.4cu.2313_b20191024 affected by CVE-2022-28581?

Yes, TOTOlink A7100RU firmware version 7.4cu.2313_b20191024 is affected by CVE-2022-28581.

How can I mitigate the vulnerability in TOTOlink A7100RU router?

To mitigate the vulnerability in TOTOlink A7100RU router, it is recommended to update the firmware to a version that has patched the command injection vulnerability.