Command injection

TOTOLink outdoor CPE CP900 V6.3c.566B20171026 discovered to contain a command injection vulnerability in the setPasswordCfg function via the adminuser and adminpassparameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-28491

The CVE-2022-28491 issue affects TOTOLink outdoor CPE CP900 (V6.3c.566_B20171026). It is a command injection vulnerability in the NTPSyncWithHost function via the host_name parameter, allowing an attacker to execute arbitrary commands through a crafted request. CVSS 3.1 base score is 9.8 (CRITICA...

CVE-2022-28494

The CVE-2022-28494 entry relates to TOTOLink outdoor CPE CP900 (version 6.3c.566_B20171026). A command injection flaw exists in the setUpgradeFW function reachable via the filename parameter, allowing an attacker to execute arbitrary commands through a crafted request. The NVD metrics indicate a ...