CVE-2022-28912
Published: 10 May 2022
Summary
CVE-2022-28912 is a critical-severity OS Command Injection (CWE-78) vulnerability in Totolink N600R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 11.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOLink N600R V5.3c.7159_B20190425 contains a command injection vulnerability, tracked as CVE-2022-28912 and assigned CWE-78, that is reachable through the filename parameter of the /setting/setUpgradeFW endpoint. The flaw received a CVSS 3.1 score of 9.8, reflecting network-accessible, unauthenticated exploitation with high impact on confidentiality, integrity, and availability.
An attacker with network reachability to the device can supply a crafted filename value that results in arbitrary command execution on the router. Successful exploitation grants the attacker full control over the affected firmware without requiring credentials or user interaction.
Public references consist of GitHub repositories that document the vulnerability and provide proof-of-concept material, but they contain no official vendor advisories or patch guidance. The associated EPSS score rose from a low baseline to a peak of 0.1127 on 2025-12-11 before receding to its current value of 0.0401, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-33347
Vulnerability details
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUpgradeFW.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.