EUVD-2022-29878

Malicious code in bioql PyPI...

CVE-2022-25133: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology router T6 V3Firmware T6V3V4.1.5cu.748B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet...

CVE-2022-25135: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability in the function recvmeshinfosync of TOTOLINK Technology router T6 V3Firmware T6V3V4.1.5cu.748B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet...

CVE-2022-25132: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3Firmware T6V3V4.1.5cu.748B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet...

PT-2022-17092

Name of the Vulnerable Software and Affected Versions TOTOLINK Technology router T6 V3 Firmware version T6 V3 V4.1.5cu.748 B20211015 Description A command injection issue in the recv mesh info sync function allows attackers to execute arbitrary commands via a crafted MQTT packet. This can be...

PT-2022-17089

Name of the Vulnerable Software and Affected Versions TOTOLINK Technology router T6 V3 Firmware version T6 V3 V4.1.5cu.748 B20211015 Description A command injection issue in the meshSlaveDlfw function allows attackers to execute arbitrary commands via a crafted MQTT packet. This enables attackers...

PT-2022-17090

Name of the Vulnerable Software and Affected Versions TOTOLINK Technology router T6 V3 Firmware version T6 V3 V4.1.5cu.748 B20211015 Description A command injection issue in the isAssocPriDevice function allows attackers to execute arbitrary commands via a crafted MQTT packet. Recommendations For...

PT-2022-17091

Name of the Vulnerable Software and Affected Versions TOTOLINK Technology router T6 V3 version T6 V3 V4.1.5cu.748 B20211015 Description A command injection issue in the setUpgradeFW function allows attackers to execute arbitrary commands via a crafted MQTT packet. This can be exploited by sending...

CVE-2022-25134: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3Firmware T6V3V4.1.5cu.748B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet...