Sign-up

ID

VAR-202205-1506


CVE

CVE-2022-29639


TITLE

TotoLink A3100R Command Injection Vulnerability (CNVD-2022-54652)

Trust: 0.6

sources: CNVD: CNVD-2022-54652

DESCRIPTION

TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a command injection vulnerability via the magicid parameter in the function uci_cloudupdate_config. TotoLink A3100R is a series of wireless routers from TotoLink, a Taiwanese company. of the constructed command. Attackers can exploit this vulnerability Causes arbitrary command execution

Trust: 1.53

sources: NVD: CVE-2022-29639 // CNVD: CNVD-2022-54652 // VULMON: CVE-2022-29639

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-54652

AFFECTED PRODUCTS

vendor:totolinkmodel:a3100rscope:eqversion:4.1.2cu.5247_b20211129

Trust: 1.0

vendor:totolinkmodel:a3100rscope:eqversion:4.1.2cu.5050_b20200504

Trust: 1.0

vendor:totolinkmodel:a3100r v4.1.2cu.5050 b20200504scope: - version: -

Trust: 0.6

vendor:totolinkmodel:a3100r v4.1.2cu.5247 b20211129scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2022-54652 // NVD: CVE-2022-29639

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-29639
value: HIGH

Trust: 1.0

CNVD: CNVD-2022-54652
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202205-3672
value: HIGH

Trust: 0.6

VULMON: CVE-2022-29639
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2022-29639
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

CNVD: CNVD-2022-54652
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2022-29639
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.2
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2022-54652 // VULMON: CVE-2022-29639 // CNNVD: CNNVD-202205-3672 // NVD: CVE-2022-29639

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2022-29639

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202205-3672

TYPE

command injection

Trust: 0.6

sources: CNNVD: CNNVD-202205-3672

PATCH

title:Patch for TotoLink A3100R Command Injection Vulnerability (CNVD-2022-54652)url:https://www.cnvd.org.cn/patchInfo/show/342361

Trust: 0.6

title:TOTOLINK A3100R Fixes for command injection vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=194456

Trust: 0.6

sources: CNVD: CNVD-2022-54652 // CNNVD: CNNVD-202205-3672

EXTERNAL IDS

db:NVDid:CVE-2022-29639

Trust: 2.3

db:CNVDid:CNVD-2022-54652

Trust: 0.6

db:CNNVDid:CNNVD-202205-3672

Trust: 0.6

db:VULMONid:CVE-2022-29639

Trust: 0.1

sources: CNVD: CNVD-2022-54652 // VULMON: CVE-2022-29639 // CNNVD: CNNVD-202205-3672 // NVD: CVE-2022-29639

REFERENCES

url:https://github.com/shijin0925/iot/blob/master/totolink%20a3100r/1.md

Trust: 2.3

url:https://cxsecurity.com/cveshow/cve-2022-29639/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/77.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2022-54652 // VULMON: CVE-2022-29639 // CNNVD: CNNVD-202205-3672 // NVD: CVE-2022-29639

SOURCES

db:CNVDid:CNVD-2022-54652
db:VULMONid:CVE-2022-29639
db:CNNVDid:CNNVD-202205-3672
db:NVDid:CVE-2022-29639

LAST UPDATE DATE

2024-11-23T22:50:47.847000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-54652date:2022-08-02T00:00:00
db:VULMONid:CVE-2022-29639date:2022-05-26T00:00:00
db:CNNVDid:CNNVD-202205-3672date:2022-05-31T00:00:00
db:NVDid:CVE-2022-29639date:2024-11-21T06:59:28.520

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-54652date:2022-08-02T00:00:00
db:VULMONid:CVE-2022-29639date:2022-05-18T00:00:00
db:CNNVDid:CNNVD-202205-3672date:2022-05-18T00:00:00
db:NVDid:CVE-2022-29639date:2022-05-18T12:15:08.233