CVE-2018-13314 — OS Command Injection in A3002ru Firmware

CWE-78 — OS Command Injection3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
15.3%
top 5.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Totolink A3002ru Firmware
Timeline
PublishedNov 27
Latest updateMay 13

Description

System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ipAddr" POST parameter.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-69j5-58xf-9g4v: System command injection in formAliasIp in TOTOLINK A3002RU version 1↗2022-05-13
▶
CVEList
CVE-2018-13314: System command injection in formAliasIp in TOTOLINK A3002RU version 1↗2018-11-27
▶
CVE-2018-13314 — OS Command Injection | cvebase