CVE-2022-26211 : Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function CloudACMunualUpdate, via the deviceMac and deviceName parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

Published 2022-03-15 22:15:15

Updated 2022-03-22 14:36:51

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2022-26211

EPSS FAQ

8.90%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 95 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-26211

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-26211

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

Products affected by CVE-2022-26211

Totolink » A830r Firmware » Version: 5.9c.4729 B20191112
cpe:2.3:o:totolink:a830r_firmware:5.9c.4729_b20191112:*:*:*:*:*:*:*
Matching versions
When used together with: Totolink » A830r » Version: N/A
Totolink » A3100r Firmware » Version: 4.1.2cu.5050 B20200504
cpe:2.3:o:totolink:a3100r_firmware:4.1.2cu.5050_b20200504:*:*:*:*:*:*:*
Matching versions
When used together with: Totolink » A3100r » Version: N/A
Totolink » A3000ru Firmware » Version: 5.9c.5185 B20201128
cpe:2.3:o:totolink:a3000ru_firmware:5.9c.5185_b20201128:*:*:*:*:*:*:*
Matching versions
When used together with: Totolink » A3000ru » Version: N/A
Totolink » A950rg Firmware » Version: 4.1.2cu.5161 B20200903
cpe:2.3:o:totolink:a950rg_firmware:4.1.2cu.5161_b20200903:*:*:*:*:*:*:*
Matching versions
When used together with: Totolink » A950rg » Version: N/A
Totolink » A810r Firmware » Version: 4.1.2cu.5182 B20201026
cpe:2.3:o:totolink:a810r_firmware:4.1.2cu.5182_b20201026:*:*:*:*:*:*:*
Matching versions
When used together with: Totolink » A810r » Version: N/A
Totolink » A800r Firmware » Version: 4.1.2cu.5137 B20200730
cpe:2.3:o:totolink:a800r_firmware:4.1.2cu.5137_b20200730:*:*:*:*:*:*:*
Matching versions
When used together with: Totolink » A800r » Version: N/A

Vulnerability Details : CVE-2022-26211

Exploit prediction scoring system (EPSS) score for CVE-2022-26211

CVSS scores for CVE-2022-26211

CWE ids for CVE-2022-26211

References for CVE-2022-26211

Products affected by CVE-2022-26211