CVE-2022-26211

Deeper analysis

Totolink routers including the A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 contain a command-injection flaw in the CloudACMunualUpdate function. The issue, tracked as CVE-2022-26211 and assigned CWE-78, arises from insufficient sanitization of the deviceMac and deviceName parameters, enabling an attacker to supply a crafted request that results in arbitrary operating-system command execution. The vulnerability carries a CVSS 3.1 score of 9.8, reflecting network attack vector, low complexity, and no required authentication or user interaction.

An unauthenticated remote attacker can exploit the flaw by sending a maliciously formatted HTTP request to an affected device, achieving full control over the router’s operating system. Successful exploitation grants the ability to read, modify, or delete data, alter device configuration, or pivot into attached networks.

Public references consist of technical write-ups that demonstrate the injection vector but contain no vendor advisory, firmware update, or mitigation guidance. The associated EPSS score has remained flat at 0.1734 with no material increase since disclosure.