CVE-2022-25077

Deeper analysis

TOTOLink A3100R routers running firmware version V4.1.2cu.5050_B20200504 contain a command-injection flaw (CWE-78) inside the Main function. The vulnerability is triggered when attacker-controlled input reaches the QUERY_STRING parameter, allowing operating-system commands to be executed with the privileges of the web server process. The issue received a CVSS 3.1 base score of 9.8, reflecting network attack vector, low complexity, and no required authentication or user interaction.

An unauthenticated attacker with network access can supply a malicious QUERY_STRING value to the affected endpoint and obtain arbitrary command execution. Successful exploitation yields full control over the device, including the ability to read or modify configuration, install persistent malware, or pivot into adjacent networks.

Public proof-of-concept code has been posted to GitHub, and the current EPSS score of 0.51 indicates a substantial likelihood of exploitation attempts. No vendor advisory or firmware update addressing the flaw is referenced in the available sources.