Cyber Resilience

CVE-2022-26206

CriticalPublic PoCRCE

Published: 15 March 2022

Published
15 March 2022
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1734 95.2th percentile
Risk Priority 30 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-26206 is a critical-severity OS Command Injection (CWE-78) vulnerability in Totolink A830R Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 4.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 contain a command injection vulnerability in the setLanguageCfg function. The flaw is triggered through the langType parameter and is tracked as CWE-78 with a CVSS 3.1 score of 9.8.

Unauthenticated attackers with network access can submit a crafted HTTP request to the affected routers and achieve arbitrary command execution on the device. No authentication or user interaction is required, enabling remote code execution that can fully compromise the router.

Public references consist of technical write-ups and proof-of-concept material hosted on GitHub that demonstrate the injection vector. No vendor advisory or firmware patch information is included in the available references.

The EPSS score for this CVE stands at 0.1734 with an identical recorded peak, indicating no material increase in observed exploitation interest after disclosure.

EU & UK References

Vulnerability details

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setLanguageCfg, via the langType parameter. This vulnerability allows attackers to execute arbitrary commands via a…

more

crafted request.

CWE(s)
CWE-78

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

totolink
a830r firmware
5.9c.4729_b20191112
totolink
a3100r firmware
4.1.2cu.5050_b20200504
totolink
a950rg firmware
4.1.2cu.5161_b20200903
totolink
a800r firmware
4.1.2cu.5137_b20200730
totolink
a3000ru firmware
5.9c.5185_b20201128
totolink
a810r firmware
4.1.2cu.5182_b20201026

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References