CVE-2022-44249

Deeper analysis

TOTOLINK NR1800X firmware version V9.1.0u.6279_B20210910 is affected by a command injection vulnerability tracked as CVE-2022-44249. The flaw, assigned CWE-78, resides in the UploadFirmwareFile function where the FileName parameter is processed without adequate sanitization, enabling arbitrary command execution. It carries a CVSS 3.1 base score of 9.8 reflecting network-accessible, unauthenticated exploitation with high impact on confidentiality, integrity, and availability.

An attacker with network reachability can supply a malicious FileName value during firmware upload to inject and execute operating-system commands on the device. Because the vector requires no credentials or user interaction, successful exploitation can result in full device compromise, including arbitrary code execution and potential persistence within the affected router.

The two provided references point to the same Notion page that documents the UploadFirmwareFile issue but contain no details on vendor patches, firmware updates, or recommended mitigations. The associated EPSS scores have remained near 0.16 with only a minor peak at 0.1657 and show no material post-disclosure climb that would indicate rising exploitation interest.