Lucene search

MitreCVE-2022-40475

HistorySep 29, 2022 - 12:15 p.m.

CVE-2022-40475

2022-09-2912:15:11

CWE-78

mitre

web.nvd.nist.gov

cve-2022-40475

totolink

a860r

command injection

cgi

downloadfile

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.449

Percentile

97.4%

JSON

TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection via the component /cgi-bin/downloadFile.cgi.

Affected configurations

Nvd

Node

totolinka860r_firmwareMatch4.1.2cu.5182_b20201027

AND

totolinka860rMatch-

VendorProductVersionCPE
totolinka860r_firmware4.1.2cu.5182_b20201027cpe:2.3:o:totolink:a860r_firmware:4.1.2cu.5182_b20201027:*:*:*:*:*:*:*
totolinka860r-cpe:2.3:h:totolink:a860r:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
totolink	a860r_firmware	4.1.2cu.5182_b20201027	cpe:2.3:o:totolink:a860r_firmware:4.1.2cu.5182_b20201027:::::::*
totolink	a860r	-	cpe:2.3:h:totolink:a860r:-:::::::*

References

github.com/1759134370/iot/blob/main/TOTOLINK/A860R/6.md

Social References

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.449

Percentile

97.4%

JSON

Related for CVE-2022-40475