CVE-2022-25134

A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3Firmware T6V3V4.1.5cu.748B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet...

CVE-2022-25133

A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology router T6 V3Firmware T6V3V4.1.5cu.748B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet...

CVE-2022-25136

A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3Firmware T6V3V4.1.5cu.748B20211015 and T10 V2Firmware V4.1.8cu.5207B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet...

Command injection

A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3Firmware T6V3V4.1.5cu.748B20211015 and T10 V2Firmware V4.1.8cu.5207B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet...

Command injection

A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3Firmware T6V3V4.1.5cu.748B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet...

Command injection

A command injection vulnerability in the function updateWifiInfo of TOTOLINK Technology routers T6 V3Firmware T6V3V4.1.5cu.748B20211015 and T10 V2Firmware V4.1.8cu.5207B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet...

Command injection

A command injection vulnerability in the function recvmeshinfosync of TOTOLINK Technology router T6 V3Firmware T6V3V4.1.5cu.748B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet...

Command injection

A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3Firmware T6V3V4.1.5cu.748B20211015 and T10 V2Firmware V4.1.8cu.5207B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet...

File Containment Vulnerability in BossCMS of Wenzhou Huyin Information Technology Co.

BossCMS is a content management system based on self-developed PHP framework MySQL architecture developed by Wenzhou Huyin Information Technology Co. A file inclusion vulnerability exists in BossCMS, which can be exploited by attackers to gain control of the server...

CVE-2022-25137

A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3Firmware T6V3V4.1.5cu.748B20211015 and T10 V2Firmware V4.1.8cu.5207B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet...

CVE-2022-25137

Affected products: TOTOLINK T6 (V3 firmware T6_V3_V4.1.5cu.748_B20211015) and TOTOLINK T10 (V2 firmware V4.1.8cu.5207_B20210320). Vulnerability: Command injection in function recvSlaveUpgstatus. Root cause: Handling of MQTT packets allows arbitrary command execution. Impact: Attacker could run ar...

CVE-2022-25136

A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3Firmware T6V3V4.1.5cu.748B20211015 and T10 V2Firmware V4.1.8cu.5207B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet...

CVE-2022-25135

The CVE-2022-25135 entry relates to a command-injection flaw in TOTOLINK T6 routers. Affected component is the function recv_mesh_info_sync in TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015. An attacker can exploit this via a crafted MQTT packet to execute arbitrary comman...

CVE-2022-25134

A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3Firmware T6V3V4.1.5cu.748B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet...

CVE-2022-25133

A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology router T6 V3Firmware T6V3V4.1.5cu.748B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet...

CVE-2022-25133

The CVE-2022-25133 entry concerns TOTOLINK T6 routers, specifically the isAssocPriDevice function in firmware T6_V3_V4.1.5cu.748_B20211015. A vulnerability allows an attacker to execute arbitrary commands by sending a crafted MQTT packet, i.e., a command-injection in the isAssocPriDevice path. Re...

CVE-2022-25134

The CVE-2022-25134 entry details a command injection vulnerability in the TOTOLINK T6 router. The flaw exists in the function setUpgradeFW of the T6_V3 firmware (V3_Firmware T6_V3_V4.1.5cu.748_B20211015). An attacker can trigger the vulnerability by sending a crafted MQTT packet , enabling arbitr...

CVE-2022-25132

CVE-2022-25132 affects TOTOLINK Tech router T6, specifically firmware referenced as T6_V3_V4.1.5cu.748_B20211015. The vulnerability is in the function meshSlaveDlfw and allows an attacker to execute arbitrary commands by sending a crafted MQTT packet, representing a remote command-injection acces...

CVE-2022-25132

A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3Firmware T6V3V4.1.5cu.748B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet...

CVE-2022-25131

A command injection vulnerability in the function recvSlaveCloudCheckStatus of TOTOLINK Technology routers T6 V3Firmware T6V3V4.1.5cu.748B20211015 and T10 V2Firmware V4.1.8cu.5207B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet...