CVE-2022-28912: OS Command Injection
Published May 10, 2022
·Updated
TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUpgradeFW.
Affected Software
2 affected components
TOTOLINK N600R firmware=5.3c.7159_b20190425
TOTOLINK N600R
Event History
May 10, 2022
CVE Published
via MITRE·01:17 PM
Data Sourced
via MITRE·01:17 PM
Description
Frequently Asked Questions
1
What is CVE-2022-28912?
CVE-2022-28912 is a command injection vulnerability found in TOTOLink N600R V5.3c.7159_B20190425 firmware.
2
How severe is CVE-2022-28912?
CVE-2022-28912 has a severity rating of 9.8 (critical).
3
How does CVE-2022-28912 affect TOTOLink N600R firmware?
CVE-2022-28912 allows an attacker to execute arbitrary commands via the filename parameter in /setting/setUpgradeFW.
4
Is TOTOLink N600R V5.3c.7159_B20190425 firmware affected by CVE-2022-28912?
Yes, TOTOLink N600R V5.3c.7159_B20190425 firmware is affected by CVE-2022-28912.
5
How can I fix the CVE-2022-28912 vulnerability in TOTOLink N600R firmware?
To fix the CVE-2022-28912 vulnerability, users should update to a patched version of the firmware provided by TOTOLink.