A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.
References
Link | Resource |
---|---|
https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-2022-25136 | Third Party Advisory VDB Entry |
https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_17/17.md | Broken Link Third Party Advisory |
Configurations
History
28 Feb 2022, 16:36
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:h:totolink:t10:-:*:*:*:*:*:*:* cpe:2.3:o:totolink:t6_firmware:v4.1.5cu.748_b20211015:*:*:*:*:*:*:* cpe:2.3:o:totolink:t10_firmware:v4.1.8cu.5207_b20210320:*:*:*:*:*:*:* cpe:2.3:h:totolink:t6:-:*:*:*:*:*:*:* |
|
First Time |
Totolink t6
Totolink t10 Firmware Totolink Totolink t10 Totolink t6 Firmware |
|
CWE | CWE-77 | |
CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 9.8 |
References |
|
|
References | (MISC) https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_17/17.md - Broken Link, Third Party Advisory |
19 Feb 2022, 00:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-02-19 00:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-25136
Mitre link : CVE-2022-25136
CVE.ORG link : CVE-2022-25136
JSON object : View
Products Affected
totolink
- t6
- t10
- t6_firmware
- t10_firmware
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')