CVE-2022-38308

Deeper analysis

TOTOLink A700RU firmware version V7.4cu.2313_B20191024 contains a command injection vulnerability in the cstesystem function, where the lang parameter is processed without adequate sanitization. The flaw is tracked as CVE-2022-38308 and is classified under CWE-78, with a CVSS 3.1 score of 9.8 reflecting network-accessible exploitation that requires no authentication or user interaction.

An unauthenticated attacker can supply a crafted payload to the affected parameter over the network and execute arbitrary operating-system commands on the device. Successful exploitation grants the attacker full control over the router, including the ability to read or modify data, alter device configuration, and potentially pivot to other systems on the local network.

Public references consist of GitHub repositories that document the issue but contain no vendor advisory, patch information, or mitigation guidance. The associated EPSS score rose to a peak of 0.2805 before receding to its current value of 0.2452, indicating measurable post-disclosure exploitation interest.