Cyber Resilience

CVE-2022-26208

CriticalPublic PoCRCE

Published: 15 March 2022

Published
15 March 2022
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1734 95.2th percentile
Risk Priority 30 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-26208 is a critical-severity OS Command Injection (CWE-78) vulnerability in Totolink A830R Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 4.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

Totolink routers including the A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 contain a command-injection flaw in the setWebWlanIdx function. The vulnerability, identified as CVE-2022-26208 and assigned CWE-78, is triggered by unsanitized input in the webWlanIdx parameter and carries a CVSS 3.1 score of 9.8.

An unauthenticated attacker with network access can submit a crafted HTTP request that causes the device to execute arbitrary operating-system commands. Successful exploitation grants the attacker full control over the router, including the ability to alter configuration, intercept traffic, or pivot into attached networks.

Public disclosures consist of technical write-ups hosted on GitHub that reproduce the issue; no vendor advisories or firmware updates are referenced in the available sources. The EPSS score has remained flat at 0.1734 since publication.

EU & UK References

Vulnerability details

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setWebWlanIdx, via the webWlanIdx parameter. This vulnerability allows attackers to execute arbitrary commands via a…

more

crafted request.

CWE(s)
CWE-78

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

totolink
a830r firmware
5.9c.4729_b20191112
totolink
a3100r firmware
4.1.2cu.5050_b20200504
totolink
a950rg firmware
4.1.2cu.5161_b20200903
totolink
a800r firmware
4.1.2cu.5137_b20200730
totolink
a3000ru firmware
5.9c.5185_b20201128
totolink
a810r firmware
4.1.2cu.5182_b20201026

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References