CVE-2022-28935

Deeper analysis

Totolink routers including the A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 contain a command injection vulnerability tracked as CVE-2022-28935 and assigned CWE-77. The flaw received a CVSS 3.1 score of 7.2 reflecting network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability when successfully exploited.

An attacker with administrative credentials can send specially crafted requests over the network to execute arbitrary operating-system commands on the affected devices, resulting in full control of the router. The requirement for high privileges limits the attack surface to authenticated administrators or compromised management accounts.

The provided references consist solely of shared Google Drive folders that do not contain vendor advisories, patch information, or mitigation guidance. The associated EPSS score has remained stable near 0.1 with a recorded peak of 0.0997 and shows no material upward trajectory after disclosure.