CVE-2022-27411
Published: 05 May 2022
Summary
CVE-2022-27411 is a critical-severity an unspecified weakness vulnerability in Totolink N600R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 10.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability CVE-2022-27411 is a command injection flaw in the TOTOLINK N600R router running firmware version v5.3c.5507_B20171031, specifically within the Main function where the QUERY_STRING parameter is processed without adequate sanitization.
Unauthenticated attackers with network access can supply crafted input to the affected parameter and execute arbitrary commands on the device, resulting in full control over confidentiality, integrity, and availability as reflected in the CVSS 9.8 rating.
The listed references point to a GitHub repository documenting IoT vulnerabilities but contain no details on patches, workarounds, or vendor mitigation steps.
EPSS for the CVE rose from a low baseline to a peak of 0.0691 on 2025-01-22 before receding to the current value of 0.0477, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-31914
Vulnerability details
TOTOLINK N600R v5.3c.5507_B20171031 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter in the "Main" function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.