CVE-2021-46007

totolink a3100r V5.9c.4577 is vulnerable to os command injection. The backend of a page is executing the "ping" command, and the input field does not adequately filter special symbols. This can lead to command injection attacks.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
VendorProductVersion
totolinkar3100r_firmware
5.9c.4577:c.4577
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://a3100r.com
http://totolink.com
https://hackmd.io/t_nRWxS2Q2O7GV2E5BhQMg
http://a3100r.com
http://totolink.com
https://hackmd.io/t_nRWxS2Q2O7GV2E5BhQMg