Cyber Resilience

CVE-2022-26209

CriticalPublic PoCRCE

Published: 15 March 2022

Published
15 March 2022
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1734 95.2th percentile
Risk Priority 30 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-26209 is a critical-severity OS Command Injection (CWE-78) vulnerability in Totolink A830R Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 4.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

Totolink routers including the A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 contain a command-injection flaw in the setUploadSetting function. The issue stems from improper handling of the FileName parameter and is tracked as CWE-78, yielding a CVSS 3.1 score of 9.8.

An unauthenticated attacker with network access can submit a crafted HTTP request that injects and executes arbitrary operating-system commands on the device. Successful exploitation grants full control over the router, enabling actions such as configuration changes, traffic interception, or persistence.

Public exploit details and proof-of-concept code have been published on GitHub, and the EPSS score has remained steady at 0.1734 since disclosure with no material upward movement observed. No vendor advisories or firmware updates addressing the issue appear in the available references.

EU & UK References

Vulnerability details

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setUploadSetting, via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a…

more

crafted request.

CWE(s)
CWE-78

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

totolink
a830r firmware
5.9c.4729_b20191112
totolink
a3100r firmware
4.1.2cu.5050_b20200504
totolink
a950rg firmware
4.1.2cu.5161_b20200903
totolink
a800r firmware
4.1.2cu.5137_b20200730
totolink
a3000ru firmware
5.9c.5185_b20201128
totolink
a810r firmware
4.1.2cu.5182_b20201026

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References