CVE-2022-27004
Published: 15 March 2022
Summary
CVE-2022-27004 is a critical-severity OS Command Injection (CWE-78) vulnerability in Totolink X5000R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 3.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Totolink routers including the X5000R running firmware V9.1.0u.6118_B20201102 and the A7000R running V9.1.0u.6115_B20201022 contain a command-injection flaw in the Tunnel 6in4 feature. The vulnerability, tracked as CVE-2022-27004 and assigned CWE-78, resides in handling of the remote6in4 parameter and permits unauthenticated attackers to supply a crafted request that results in arbitrary command execution on the device.
Because the flaw is reachable over the network without credentials or user interaction and carries a CVSS score of 9.8, any remote attacker can obtain full control of the affected router. Public proof-of-concept material demonstrates how an HTTP request can be manipulated to inject shell commands through the 6in4 tunnel configuration endpoint.
The associated EPSS score has reached 0.3065, indicating a substantial probability of exploitation. No vendor advisory or firmware update addressing the issue is referenced in the available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-31544
Vulnerability details
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6in4 function via the remote6in4 parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.