Orta CVSS 6.5 PoC var
CVE-2025-60702: A950rg Firmware: komut enjeksiyonu
Açıklama (NVD)
A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. The `setDiagnosisCfg` function retrieves the `ipDoamin` parameter from user input via `websGetVar` and concatenates it directly into a `ping` system command executed via `CsteSystem()` without any sanitization. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.
Özet bilgiler
- Ürün
- Totolink A950rg Firmware
- CVSS v3.1
- 6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - EPSS
- %2,56 (yüzdelik 85)
- CWE
- CWE-77
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| totolink-a950rg-firmware | 5.9c.4592_b20191022 | 5.9c.4592_b20191022 | — |