CVE-2022-37843
CRITICALTOTOLINK A860R V4.1.2cu.5182_B20201027 - OS Command Injection via cstecgi.cgi
Title source: llmDescription
In TOTOLINK A860R V4.1.2cu.5182_B20201027 in cstecgi.cgi, the acquired parameters are directly put into the system for execution without filtering, resulting in a command injection vulnerability.
References (1)
Core 1
Core References
Broken Link, Third Party Advisory x_refsource_misc
https://github.com/1759134370/iot/blob/main/TOTOLINK/A860R/4.md
Scores
CVSS v3
9.8
EPSS
0.0065
EPSS Percentile
71.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
Status
published
Products (1)
totolink/a860r_firmware
4.1.2cu.5182_b20201027
Published
Sep 06, 2022
Tracked Since
Feb 18, 2026