CVE-2022-44250

Deeper analysis

CVE-2022-44250 is a command-injection vulnerability (CWE-78) affecting the TOTOLINK NR1800X router running firmware version V9.1.0u.6279_B20210910. The flaw resides in the setOpModeCfg function, where the hostName parameter is processed without adequate sanitization, allowing arbitrary command execution. It carries a CVSS 3.1 base score of 9.8, reflecting network-accessible exploitation with no required credentials or user interaction and full impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can supply a malicious hostName value to the affected function over the network, resulting in execution of arbitrary operating-system commands on the device. Successful exploitation grants complete control of the router, enabling actions such as configuration changes, traffic interception, or use of the device as a pivot point into the attached network.

The two provided references point to the same Notion page describing a similar command-injection issue in another TOTOLINK model; neither the CVE record nor the references contain details on vendor patches, firmware updates, or recommended mitigations. The associated EPSS score has remained essentially flat, with a current value of 0.1447 and a recorded peak of 0.1490.