CVE-2022-25084

Deeper analysis

TOTOLink T6 firmware version V5.9c.4085_B20190428 contains a command-injection flaw (CWE-78) in the Main function. Untrusted input supplied through the QUERY_STRING parameter is passed directly to a system command without sanitization, allowing arbitrary operating-system commands to be executed with the privileges of the web server process. The vulnerability carries a CVSS 3.1 base score of 9.8, reflecting network attackability without authentication or user interaction.

An unauthenticated remote attacker can exploit the issue simply by sending an HTTP request containing a crafted QUERY_STRING value. Successful exploitation grants the attacker the ability to execute arbitrary commands, read or modify device configuration, install persistent malware, or pivot into attached networks.

Public proof-of-concept code has been available since disclosure, and the CVE maintains a high EPSS score of 0.8426 at both its current and peak values, indicating sustained exploitation interest. No vendor advisory or firmware update addressing the flaw is referenced in the available sources.