CVE-2021-44247

CRITICAL

9.8

Description

Totolink devices A3100R v4.1.2cu.5050_B20200504, A830R v5.9c.4729_B20191112, and A720R v4.1.5cu.470_B20200911 were discovered to contain command injection vulnerability in the function setNoticeCfg. This vulnerability allows attackers to execute arbitrary commands via the IpFrom parameter.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie2/4/2022

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

totolink:a3100rtotolink:a3100r_firmwaretotolink:a720rtotolink:a720r_firmwaretotolink:a830rtotolink:a830r_firmware

Faiblesses (CWE)

CWE-77

References

https://github.com/pjqwudi/my_vuln/blob/main/totolink/vuln_1/1.md(cve@mitre.org)

https://github.com/pjqwudi/my_vuln/blob/main/totolink/vuln_1/1.md(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.