CVE-2022-27005
Published: 15 March 2022
Summary
CVE-2022-27005 is a critical-severity OS Command Injection (CWE-78) vulnerability in Totolink X5000R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 2.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Totolink routers X5000R version V9.1.0u.6118_B20201102 and A7000R version V9.1.0u.6115_B20201022 contain a command injection vulnerability in the setWanCfg function. The flaw is triggered through the hostName parameter and is tracked as CVE-2022-27005 with CWE-78. It received a CVSS 3.1 score of 9.8 reflecting network-accessible exploitation without credentials or user interaction.
An unauthenticated attacker can submit a crafted request to the affected WAN configuration endpoint and achieve arbitrary command execution on the device. Successful exploitation grants full control over the router, enabling actions such as traffic interception, persistence, or lateral movement within the attached network.
The EPSS score stands at 0.4594 with no material increase from an earlier low baseline. Public references consist of a technical disclosure detailing the vulnerable parameter and request format but contain no vendor advisory or patch information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-31545
Vulnerability details
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the setWanCfg function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.