CVE-2022-28906
Published: 10 May 2022
Summary
CVE-2022-28906 is a critical-severity OS Command Injection (CWE-78) vulnerability in Totolink N600R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 4.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOLink N600R V5.3c.7159_B20190425 contains a command injection vulnerability, tracked as CVE-2022-28906 and assigned CWE-78, that is reachable through the langtype parameter in the /setting/setLanguageCfg endpoint. The flaw received a CVSS 3.1 base score of 9.8, reflecting network attackability without authentication or user interaction and full impact on confidentiality, integrity, and availability.
An unauthenticated remote attacker can supply a crafted langtype value to execute arbitrary operating-system commands on the device. Successful exploitation grants the attacker complete control over the router, enabling actions such as configuration changes, traffic interception, or use of the device as an attack pivot.
Public proof-of-concept code demonstrating the injection has been published on GitHub. The CVE maintains an EPSS score of 0.1855 with a recorded peak of 0.2014, indicating moderate and relatively stable exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-33341
Vulnerability details
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the langtype parameter in /setting/setLanguageCfg.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.