Cyber Resilience

CVE-2022-26210

CriticalPublic PoCRCE

Published: 15 March 2022

Published
15 March 2022
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0986 93.2th percentile
Risk Priority 26 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-26210 is a critical-severity OS Command Injection (CWE-78) vulnerability in Totolink A830R Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 6.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

Totolink routers including the A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 contain a command-injection flaw in the setUpgradeFW function. The vulnerability is triggered through the FileName parameter and stems from insufficient sanitization of user-supplied input, corresponding to CWE-78. With a CVSS 3.1 score of 9.8, the issue permits unauthenticated remote code execution.

An attacker with network access can submit a crafted HTTP request that injects operating-system commands via the FileName field. Successful exploitation grants full control over the device, allowing arbitrary command execution with no credentials or user interaction required.

Public proof-of-concept code demonstrating the injection has been published on GitHub. The EPSS score rose from a low baseline to a peak of 0.4808 on 2026-04-29 before receding to the current value of 0.0986, indicating a clear increase in observed exploitation interest after disclosure. No vendor advisory or firmware update information is referenced in the available sources.

EU & UK References

Vulnerability details

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setUpgradeFW, via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a…

more

crafted request.

CWE(s)
CWE-78

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

totolink
a830r firmware
5.9c.4729_b20191112
totolink
a3100r firmware
4.1.2cu.5050_b20200504
totolink
a950rg firmware
4.1.2cu.5161_b20200903
totolink
a800r firmware
4.1.2cu.5137_b20200730
totolink
a3000ru firmware
5.9c.5185_b20201128
totolink
a810r firmware
4.1.2cu.5182_b20201026

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References