CVE-2022-26209 | ByteOS Network

Vulnerability Details :

CVE-2022-26209

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-15 Mar, 2022 | 21:56

Updated At-03 Aug, 2024 | 04:56

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setUploadSetting, via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:15 Mar, 2022 | 21:56

Updated At:03 Aug, 2024 | 04:56

▼CVE Numbering Authority (CNA)

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setUploadSetting, via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

Affected Products

Vendor

Product

Versions

Affected

n/a

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_24/24.md	x_refsource_MISC

Hyperlink: https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_24/24.md

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_24/24.md	x_refsource_MISC x_transferred

Hyperlink: https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_24/24.md

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

Source:cve@mitre.org

Published At:15 Mar, 2022 | 22:15

Updated At:08 Aug, 2023 | 14:22

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setUploadSetting, via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P

Type: Primary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 7.5

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

>>a830r_firmware>>5.9c.4729_b20191112

cpe:2.3:o:totolink:a830r_firmware:5.9c.4729_b20191112:*:*:*:*:*:*:*

>>a830r>>-

cpe:2.3:h:totolink:a830r:-:*:*:*:*:*:*:*

>>a3100r_firmware>>4.1.2cu.5050_b20200504

cpe:2.3:o:totolink:a3100r_firmware:4.1.2cu.5050_b20200504:*:*:*:*:*:*:*

cpe:2.3:h:totolink:a3100r:-:*:*:*:*:*:*:*

>>a950rg_firmware>>4.1.2cu.5161_b20200903

cpe:2.3:o:totolink:a950rg_firmware:4.1.2cu.5161_b20200903:*:*:*:*:*:*:*

cpe:2.3:h:totolink:a950rg:-:*:*:*:*:*:*:*

>>a800r_firmware>>4.1.2cu.5137_b20200730

cpe:2.3:o:totolink:a800r_firmware:4.1.2cu.5137_b20200730:*:*:*:*:*:*:*

>>a800r>>-

cpe:2.3:h:totolink:a800r:-:*:*:*:*:*:*:*

>>a3000ru_firmware>>5.9c.5185_b20201128

cpe:2.3:o:totolink:a3000ru_firmware:5.9c.5185_b20201128:*:*:*:*:*:*:*

cpe:2.3:h:totolink:a3000ru:-:*:*:*:*:*:*:*

>>a810r_firmware>>4.1.2cu.5182_b20201026

cpe:2.3:o:totolink:a810r_firmware:4.1.2cu.5182_b20201026:*:*:*:*:*:*:*

>>a810r>>-

cpe:2.3:h:totolink:a810r:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-78	Primary	nvd@nist.gov

CWE ID: CWE-78

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_24/24.md	cve@mitre.org	Exploit Third Party Advisory

Hyperlink: https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_24/24.md

Source: cve@mitre.org

Resource:

Exploit

Third Party Advisory