Sign-up

VARIoT IoT vulnerabilities database

Affected products: vendor, model and version
CWE format is 'CWE-number'. Threat type can be: remote or local
Look up free text in title and description

VAR-202203-1307 CVE-2022-26207 Command Injection Vulnerability in Multiple TotoLink Products (CNVD-2022-47972) CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setDiagnosisCfg, via the ipDoamin parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Totolink A830R/A3100R/A950RG/A800R/A3000RU/A810R and other products are all routers from China Totolink Company
VAR-202203-0701 CVE-2022-26209 Command Injection Vulnerability in Multiple TotoLink Products (CNVD-2022-47969) CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setUploadSetting, via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Totolink A830R/A3100R/A950RG/A800R/A3000RU/A810R and other products are all routers from China Totolink Company
VAR-202203-1289 CVE-2022-27002 ARRIS TR3300 OS Command Injection Vulnerability CVSS V2: 10.0
CVSS V3: 9.8
Severity: CRITICAL
Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the ddns function via the ddns_name, ddns_pwd, h_ddns、ddns_host parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request. ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS Company in the United States
VAR-202203-1308 CVE-2022-26206 Command Injection Vulnerability in Multiple TotoLink Products (CNVD-2022-47971) CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setLanguageCfg, via the langType parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Totolink A830R/A3100R/A950RG/A800R/A3000RU/A810R and other products are all routers from China Totolink Company
VAR-202203-0694 CVE-2022-26995 CommScope  of  arris tr3300  in the firmware  OS  Command injection vulnerability CVSS V2: 10.0
CVSS V3: 9.8
Severity: CRITICAL
Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pptp (wan_pptp.html) function via the pptp_fix_ip, pptp_fix_mask, pptp_fix_gw, and wan_dns1_stat parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request. (DoS) It may be in a state. ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS Company in the United States
VAR-202203-0691 CVE-2022-27000 ARRIS TR3300 Command Injection Vulnerability (CNVD-2022-68526) CVSS V2: 10.0
CVSS V3: 9.8
Severity: CRITICAL
Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the time and time zone function via the h_primary_ntp_server, h_backup_ntp_server, and h_time_zone parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request. ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS Company in the United States. of the constructed command
VAR-202203-0699 CVE-2022-26211 Command Injection Vulnerability in Multiple TotoLink Products (CNVD-2022-47975) CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function CloudACMunualUpdate, via the deviceMac and deviceName parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Totolink A830R/A3100R/A950RG/A800R/A3000RU/A810R and other products are all routers from China Totolink Company. The vulnerability stems from the fact that the deviceName and deviceMac parameters in the CloudACMunualUpdate function fail to properly filter special elements that construct commands
VAR-202203-0693 CVE-2022-26998 ARRIS TR3300 Command Injection Vulnerability (CNVD-2022-68524) CVSS V2: 10.0
CVSS V3: 9.8
Severity: CRITICAL
Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the wps setting function via the wps_enrolee_pin parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS Corporation in the United States
VAR-202203-1291 CVE-2022-27001 ARRIS TR3300 Command Injection Vulnerability CVSS V2: 10.0
CVSS V3: 9.8
Severity: CRITICAL
Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the dhcp function via the hostname parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS Company in the United States. of the constructed command
VAR-202203-1299 CVE-2022-26993 Command Injection Vulnerability in Multiple ARRIS Products (CNVD-2022-68533) CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the pppoe function via the pppoeUserName, pppoePassword, and pppoe_Service parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request. ARRIS SBR-AC1900P, SBR-AC3200P and SBR-AC1200P are a Wi-Fi router from ARRIS Corporation in the United States
VAR-202203-0685 CVE-2022-27004 TotoLink X5000R and TotoLink A7000R Command Injection Vulnerability CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6in4 function via the remote6in4 parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. The Totolink X5000R is a router from the Chinese company Totolink. TotoLink A7000R is a wireless router from China TotoLink Company
VAR-202203-1297 CVE-2022-26996 ARRIS TR3300 Command Injection Vulnerability (CNVD-2022-68528) CVSS V2: 10.0
CVSS V3: 9.8
Severity: CRITICAL
Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pppoe function via the pppoe_username, pppoe_passwd, and pppoe_servicename parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request. ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS Corporation in the United States
VAR-202203-0695 CVE-2022-26994 Command Injection Vulnerability in Multiple ARRIS Products (CNVD-2022-68532) CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the pptp function via the pptpUserName and pptpPassword parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request. ARRIS SBR-AC1900P, SBR-AC3200P and SBR-AC1200P are a Wi-Fi router from ARRIS Corporation in the United States
VAR-202203-1306 CVE-2022-26208 Command Injection Vulnerability in Multiple TotoLink Products (CNVD-2022-47968) CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setWebWlanIdx, via the webWlanIdx parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Totolink A830R/A3100R/A950RG/A800R/A3000RU/A810R and other products are all routers from China Totolink Company
VAR-202203-0696 CVE-2022-26992 Command Injection Vulnerabilities in Multiple ARRIS Products CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the ddns function via the DdnsUserName, DdnsHostName, and DdnsPassword parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request. ARRIS SBR-AC1900P, SBR-AC3200P and SBR-AC1200P are a Wi-Fi router from ARRIS Corporation in the United States
VAR-202203-0684 CVE-2022-27003 TotoLink X5000R and TotoLink A7000R Command Injection Vulnerability (CNVD-2022-21813) CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6rd function via the relay6rd parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. The Totolink X5000R is a router from the Chinese company Totolink. TotoLink A7000R is a wireless router from China TotoLink Company
VAR-202203-0686 CVE-2022-27005 Totolink X5000R and TotoLink A7000R Command Injection Vulnerability CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the setWanCfg function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. The Totolink X5000R is a router from the Chinese company Totolink. TotoLink A7000R is a wireless router from China TotoLink Company
VAR-202203-1302 CVE-2022-26214 Command Injection Vulnerability in Multiple TotoLink Products (CNVD-2022-47974) CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function NTPSyncWithHost. This vulnerability allows attackers to execute arbitrary commands via the host_time parameter. Totolink A830R/A3100R/A950RG/A800R/A3000RU/A810R and other products are all routers from China Totolink Company. The vulnerability stems from the fact that the host_time parameter in the NTPSyncWithHost function fails to properly filter the special elements that construct the command
VAR-202203-1301 CVE-2022-26990 Command Injection Vulnerability in Multiple ARRIS Products (CNVD-2022-68531) CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the firewall-local log function via the EmailAddress, SmtpServerName, SmtpUsername, and SmtpPassword parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request. ARRIS SBR-AC1900P, SBR-AC3200P and SBR-AC1200P are a Wi-Fi router from ARRIS Corporation in the United States. The vulnerability stems from the failure of the firewall's local log function to properly filter and construct special characters, commands, and so on
VAR-202203-0700 CVE-2022-26210 Command Injection Vulnerability in Multiple TotoLink Products (CNVD-2022-47970) CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setUpgradeFW, via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. Totolink A830R/A3100R/A950RG/A800R/A3000RU/A810R and other products are all routers from China Totolink Company