CVE-2022-26213

Totolink X5000RFirmware v9.1.0u.6118B20201102 was discovered to contain a command injection vulnerability in the function setNtpCfg, via the tz parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-27005

CVE-2022-27005 affects Totolink X5000R (version 9.1.0u.6118_B20201102) and Totolink A7000R (version 9.1.0u.6115_B20201022). The Red Hat/PRION/CVE ecosystem entries describe a command-injection in the setWanCfg function via the hostName parameter, enabling arbitrary command execution through a cra...

CVE-2022-26207

Totolink devices Totolink A830R, A3100R, A950RG, A800R, A3000RU and A810R are affected by a command-injection in the function setDiagnosisCfg via the ipDoamin parameter. Successful exploitation could allow arbitrary command execution. The Red Hat/PRION/CPAI coverage consistently references the sa...

Multiple TotoLink products have vulnerabilities related to operating system injection commands.

Totolink A830R/A3100R/A950RG/A800R/A3000RU/A810R products are one of the routers from Totolink China. Several TotoLink products have a command injection vulnerability, which can be exploited by attackers to execute arbitrary commands via crafted requests...

CVE-2022-26210: Improper Neutralization of Special Elements used in an OS Command

Totolink A830R V5.9c.4729B20191112, A3100R V4.1.2cu.5050B20200504, A950RG V4.1.2cu.5161B20200903, A800R V4.1.2cu.5137B20200730, A3000RU V5.9c.5185B20201128, and A810R V4.1.2cu.5182B20201026 were discovered to contain a command injection vulnerability in the function setUpgradeFW, via the FileName...

CVE-2022-27004: Improper Neutralization of Special Elements used in an OS Command

Totolink routers s X5000R V9.1.0u.6118B20201102 and A7000R V9.1.0u.6115B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6in4 function via the remote6in4 parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-26214: Improper Neutralization of Special Elements used in an OS Command

Totolink A830R V5.9c.4729B20191112, A3100R V4.1.2cu.5050B20200504, A950RG V4.1.2cu.5161B20200903, A800R V4.1.2cu.5137B20200730, A3000RU V5.9c.5185B20201128, and A810R V4.1.2cu.5182B20201026 were discovered to contain a command injection vulnerability in the function NTPSyncWithHost. This...

TOTOLINK X5000R and TOTOLINK A7000R have operating system command injection vulnerabilities

Totolink X5000R is a router from Totolink, China.TotoLink A7000R is a wireless router from TotoLink, China.Totolink routers X5000R V9.1.0u.6118B20201102 and A7000R V9.1.0u.6115 B20201022 contain a security vulnerability that allows attackers to execute arbitrary commands via crafted requests...

TOTOLINK X5000R and TOTOLINK A7000R have operating system command injection vulnerabilities

Totolink X5000R is a router from Totolink China.TotoLink A7000R is a wireless router from TotoLink China. A security vulnerability exists in the X5000R V9.1.0u.6118B20201102 and A7000R V9.1.0u.6115B20201022 of Totolink routers, which can be exploited by an attacker to execute arbitrary commands v...

ARRIS SBR-AC1900P and ARRIS SBR-AC3200P have operating system command injection vulnerabilities

ARRIS SBR-AC1900P, SBR-AC3200P and SBR-AC1200P is a Wi-Fi router from ARRIS USA. Multiple ARRIS products are vulnerable to a command injection vulnerability, which stems from the TimeZone parameter in the ntp function failing to properly filter the construct command special characters, commands,...

TotoLink X5000R operating system command injection vulnerability

Totolink X5000R is a router from China-based Jion Electronics Totolink. a command injection vulnerability exists in Totolink X5000R v9.1.0u.6118B20201102, which stems from a failure of the tz parameter in the setNtpCfg function to properly filter the special element of the constructed command. An...

ARRIS TR3300 Command Injection Vulnerability

ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS U.S.A. A command injection vulnerability exists in ARRIS TR3300, which stems from the failure of the hostname parameter in the dhcp function to properly filter the construct command special characters, commands, etc. An attacker could use this...

ARRIS TR3300 Command Injection Vulnerability

ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS U.S.A. A command injection vulnerability exists in ARRIS TR3300, which stems from the failure of the htimezone parameter in the time zone function to properly filter the construct command special characters, commands, etc. The vulnerability can ...

ARRIS SBR-AC1900P and ARRIS SBR-AC3200P have operating system command injection vulnerabilities

ARRIS SBR-AC1900P, SBR-AC3200P and SBR-AC1200P is a Wi-Fi router from ARRIS, Inc. Multiple ARRIS products are vulnerable to a command injection vulnerability, which stems from the pptpUserName and pptpPassword parameters in the pptp function failing to properly filter the construct command specia...

ARRIS TR3300 Command Injection Vulnerability

ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS U.S.A. A command injection vulnerability exists in ARRIS TR3300, which stems from the failure of the pptpfixip, pptpfixmask, pptpfixgw, and wandns1stat parameters in the pptp function. properly filter the construct command special characters,...

CVE-2022-21187

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...

Command injection

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...

PYSEC-2022-163

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...

PYSEC-2022-163

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...

CVE-2022-21187

The CVE-2022-21187 issue affects the libvcs package prior to version 0.11.1. The vulnerability arises in the update_repo path (when using Mercurial via hg), where the url parameter is passed to the hg clone command, enabling command injection and potential arbitrary command execution. Available c...