CVE-2022-28579

Deeper analysis

CVE-2022-28579 is a command injection vulnerability, tracked under CWE-78, that affects the setParentalRules interface in the TOTOLINK A7100RU router running firmware version 7.4cu.2313_b20191024. The flaw permits an unauthenticated attacker to supply a crafted payload that results in execution of arbitrary operating-system commands on the device. It carries a CVSS 3.1 base score of 9.8, reflecting network attack vector, low complexity, and no required privileges or user interaction.

An attacker with network reachability to the router can exploit the interface directly to run commands of their choosing. Successful exploitation grants the ability to read, modify, or delete data and to alter device behavior, consistent with the high confidentiality, integrity, and availability impacts assigned in the CVSS vector.

Public references consist of GitHub repositories that document the vulnerability and include proof-of-concept material; no vendor advisory or patch information is provided in the available references. The CVE’s EPSS score has reached a peak of 0.2031 with a current value of 0.1871, indicating sustained moderate exploitation interest since disclosure.