Details of VAR-202203-0699

ID

VAR-202203-0699

CVE

CVE-2022-26211

TITLE

Command Injection Vulnerability in Multiple TotoLink Products (CNVD-2022-47975)

Trust: 0.6

sources: CNVD: CNVD-2022-47975

DESCRIPTION

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function CloudACMunualUpdate, via the deviceMac and deviceName parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Totolink A830R/A3100R/A950RG/A800R/A3000RU/A810R and other products are all routers from China Totolink Company. The vulnerability stems from the fact that the deviceName and deviceMac parameters in the CloudACMunualUpdate function fail to properly filter special elements that construct commands

Trust: 1.44

sources: NVD: CVE-2022-26211 // CNVD: CNVD-2022-47975

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2022-47975

AFFECTED PRODUCTS

vendor:	totolink	model:	a800r	scope:	eq	version:	4.1.2cu.5137_b20200730	Trust: 1.0
vendor:	totolink	model:	a950rg	scope:	eq	version:	4.1.2cu.5161_b20200903	Trust: 1.0
vendor:	totolink	model:	a3000ru	scope:	eq	version:	5.9c.5185_b20201128	Trust: 1.0
vendor:	totolink	model:	a830r	scope:	eq	version:	5.9c.4729_b20191112	Trust: 1.0
vendor:	totolink	model:	a3100r	scope:	eq	version:	4.1.2cu.5050_b20200504	Trust: 1.0
vendor:	totolink	model:	a810r	scope:	eq	version:	4.1.2cu.5182_b20201026	Trust: 1.0
vendor:	totolink	model:	a3100r v4.1.2cu.5050 b20200504	scope:	-	version:	-	Trust: 0.6
vendor:	totolink	model:	a800r v4.1.2cu.5137 b20200730	scope:	-	version:	-	Trust: 0.6
vendor:	totolink	model:	a810r v4.1.2cu.5182 b20201026	scope:	-	version:	-	Trust: 0.6
vendor:	totolink	model:	a830r v5.9c.4729 b20191112	scope:	-	version:	-	Trust: 0.6
vendor:	totolink	model:	a950rg v4.1.2cu.5161 b20200903	scope:	-	version:	-	Trust: 0.6
vendor:	totolink	model:	a3000ru v5.9c.5185 b20201128	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2022-47975 // NVD: CVE-2022-26211

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2022-26211
value:	CRITICAL
Trust: 1.0
CNVD:	CNVD-2022-47975
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202203-1484
value:	CRITICAL
Trust: 0.6

nvd@nist.gov:	CVE-2022-26211
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
CNVD:	CNVD-2022-47975
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2022-26211
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0

sources: CNVD: CNVD-2022-47975 // CNNVD: CNNVD-202203-1484 // NVD: CVE-2022-26211

PROBLEMTYPE DATA

problemtype:

CWE-78

Trust: 1.0

sources: NVD: CVE-2022-26211

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202203-1484

TYPE

command injection

Trust: 0.6

sources: CNNVD: CNNVD-202203-1484

EXTERNAL IDS

db:	NVD	id:	CVE-2022-26211	Trust: 2.2
db:	CNVD	id:	CNVD-2022-47975	Trust: 0.6
db:	CNNVD	id:	CNNVD-202203-1484	Trust: 0.6

sources: CNVD: CNVD-2022-47975 // CNNVD: CNNVD-202203-1484 // NVD: CVE-2022-26211

REFERENCES

url:	https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_25/25.md	Trust: 2.2
url:	https://cxsecurity.com/cveshow/cve-2022-26211/	Trust: 0.6

sources: CNVD: CNVD-2022-47975 // CNNVD: CNNVD-202203-1484 // NVD: CVE-2022-26211

SOURCES

db:	CNVD	id:	CNVD-2022-47975
db:	CNNVD	id:	CNNVD-202203-1484
db:	NVD	id:	CVE-2022-26211

LAST UPDATE DATE

2024-11-23T22:44:03.290000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2022-47975	date:	2022-06-28T00:00:00
db:	CNNVD	id:	CNNVD-202203-1484	date:	2022-04-01T00:00:00
db:	NVD	id:	CVE-2022-26211	date:	2024-11-21T06:53:36.103

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2022-47975	date:	2022-06-28T00:00:00
db:	CNNVD	id:	CNNVD-202203-1484	date:	2022-03-15T00:00:00
db:	NVD	id:	CVE-2022-26211	date:	2022-03-15T22:15:14.587