CVE-2021-46007

EUVD-2021-32713
totolink a3100r V5.9c.4577 is vulnerable to os command injection. The backend of a page is executing the "ping" command, and the input field does not adequately filter special symbols. This can lead to command injection attacks.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
Affected Products (NVD)
VendorProductVersion
totolinkar3100r_firmware
5.9c.4577:c.4577
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://a3100r.com
http://totolink.com
https://hackmd.io/t_nRWxS2Q2O7GV2E5BhQMg
http://a3100r.com
http://totolink.com
https://hackmd.io/t_nRWxS2Q2O7GV2E5BhQMg