CVE-2022-28905

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the devicemac parameter in /setting/setDeviceName...

TOTOLINK N600R Router Command Injection (CVE-2022-26186; CVE-2022-26188; CVE-2022-26189; CVE-2022-27411; CVE-2022-28905; CVE-2022-28906; CVE-2022-28907; CVE-2022-28908; CVE-2022-28909; CVE-2022-28910; CVE-2022-28911; CVE-2022-28912; CVE-2022-28913)

A command injection vulnerability exists in TOTOLINK N600R router. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

CVE-2022-28905

TOTOLink N600R (versions including V5.3c.7159_B20190425) contains a command injection vulnerability reachable through the devicemac parameter in the /setting/setDeviceName API. The root cause is an unsafely handled input in the devicemac field, enabling arbitrary command execution on the device. ...