Cyber Resilience

CVE-2022-28491

CriticalPublic PoCRCE

Published: 23 March 2023

Published
23 March 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0566 90.6th percentile
Risk Priority 23 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-28491 is a critical-severity OS Command Injection (CWE-78) vulnerability in Totolink Cp900 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 9.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

TOTOLink outdoor CPE CP900 version V6.3c.566_B20171026 contains a command injection vulnerability in the NTPSyncWithHost function. The flaw is triggered when the host_name parameter is processed without adequate sanitization, allowing an attacker to supply a crafted value that is passed directly to a system command. The issue is tracked as CWE-78 and carries a CVSS 3.1 base score of 9.8.

An unauthenticated remote attacker can send a single HTTP request containing a malicious host_name value to the affected device. Successful exploitation results in arbitrary command execution with the privileges of the web server process, enabling full control over the device including configuration changes, persistence, or use as a foothold for further network attacks.

Public references consist of GitHub repositories that reproduce the flaw through proof-of-concept requests; no vendor advisory, firmware update, or official mitigation guidance is referenced in the available sources. The EPSS score remains flat at 0.0566 with no observed increase after disclosure.

EU & UK References

Vulnerability details

TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 contains a command injection vulnerability in the NTPSyncWithHost function via the host_name parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

CWE(s)
CWE-78

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

totolink
cp900 firmware
6.3c.566_b20171026

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References