CVE-2022-44252
Published: 23 November 2022
Summary
CVE-2022-44252 is a critical-severity OS Command Injection (CWE-78) vulnerability in Totolink Lr350 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-44252 is a command injection vulnerability (CWE-78) affecting the TOTOLINK NR1800X router running firmware version V9.1.0u.6279_B20210910. The flaw resides in the setUploadSetting function, where the FileName parameter is processed without adequate sanitization, allowing arbitrary command execution. It carries a CVSS 3.1 base score of 9.8, reflecting network-accessible exploitation with no required authentication or user interaction and full impact on confidentiality, integrity, and availability.
An unauthenticated attacker can supply a malicious FileName value over the network to the affected function, resulting in execution of operating-system commands on the device. Successful exploitation grants complete control of the router, enabling actions such as configuration changes, traffic interception, persistence, or use of the device as a pivot point into connected networks.
The EPSS score has remained in a narrow band near 0.15 with no pronounced post-disclosure increase. No official vendor advisory or patch information is referenced in the available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-47201
Vulnerability details
TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the setUploadSetting function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.