CVE-2022-28913

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUploadSetting...

CVE-2022-28912

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUpgradeFW...

CVE-2022-28908

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the ipdoamin parameter in /setting/setDiagnosisCfg...

CVE-2022-28905

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the devicemac parameter in /setting/setDeviceName...

CVE-2022-28906

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the langtype parameter in /setting/setLanguageCfg...

Command injection

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the langtype parameter in /setting/setLanguageCfg...

Command injection

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/CloudACMunualUpdate...

Command injection

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the webwlanidx parameter in /setting/setWebWlanIdx...

Command injection

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUploadSetting...

Command injection

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the hosttime function in /setting/NTPSyncWithHost...

CVE-2022-28912

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUpgradeFW...

CVE-2022-28913

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUploadSetting...

CVE-2022-28912

CVE-2022-28912 affects TOTOLink N600R devices (firmware version V5.3c.7159_B20190425). The vulnerability is a command injection via the filename parameter in the /setting/setUpgradeFW API, caused by unsafely handling input. Reported impact in CVSS metrics is high/critical with network access, no ...

CVE-2022-28911

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/CloudACMunualUpdate...

CVE-2022-28911

CVE-2022-28911 affects TOTOLink N600R (firmware v5.3c.7159_B20190425). A command injection is possible via the filename parameter in the /setting/CloudACMunualUpdate endpoint, enabling arbitrary command execution with network access (no user interaction) and high impact per CVSS (up to 9.8/CRITIC...

CVE-2022-28910

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the devicename parameter in /setting/setDeviceName...

CVE-2022-28909

Totolink N600R v5.3c.7159_B20190425 is affected by a command injection in the webwlanidx parameter of the /setting/setWebWlanIdx API. The issue is documented across multiple sources (CVE-2022-28909 and related advisories) and is classified as a high/critical risk with network attack vector, no pr...

CVE-2022-28908

CVE-2022-28908 affects TOTOLink N600R router (firmware version V5.3c.7159_B20190425). A command injection vulnerability exists via the ipdoamin parameter in the /setting/setDiagnosisCfg endpoint, enabling remote code execution as described in multiple sources. The initial documents do not provide...

CVE-2022-28907

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the hosttime function in /setting/NTPSyncWithHost...

CVE-2022-28907

TOTOLink N600R (firmware ~5.3c.7159_B20190425) is affected by a command injection vulnerability in the hosttime function exposed via /setting/NTPSyncWithHost. The issue allows an attacker to inject and execute arbitrary commands on the device. Public sources do not provide an official patch detai...