CVE-2022-26187
published 2022-03-22CVE-2022-26187: TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function.
PriorityP187critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
19.58%
97.0th percentile
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| totolink | n600r_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
path/cgi-bin/cstecgi.cgi
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS TOTOLINK N600R cstecgi.cgi ipDoamin parameter Command Injection Attempt (CVE-2022-26187)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:20; content:"/cgi-bin/cstecgi.cgi"; http.request_body; content:"|22|topicurl|22 3a|"; content:"|22|setting/setDiagnosisCfg|22|"; within:30; fast_pattern; content:"|22|ipDoamin|22 3a|"; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,github.com/doudoudedi/TOTOLINK_N600R_Command_Injection/blob/main/TOTOLINK-N600R-Command-Injection.md; reference:cve,2022-26187; classtype:attempted-admin; sid:2061799; rev:1; metadata:affected_product TOTOLINK, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_04_22, cve CVE_2022_26187, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_04_22, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
- →Look for HTTP POST requests to /cgi-bin/cstecgi.cgi with a JSON body containing the topicurl value 'setting/setDiagnosisCfg' and the 'ipDoamin' parameter — note the intentional typo in the parameter name.
- →Flag injection characters (semicolon, newline, backtick, pipe, dollar sign) in the ipDoamin parameter value, including both raw and URL-encoded forms: %3B, %0A, %60, %7C, %24.
- →The vulnerability is in the pingCheck function; monitor for OS command execution originating from the TOTOLINK N600R web management process.
- →Traffic is expected over plaintext HTTP (not TLS); deploy detection at the network perimeter and internally.
- ·The vulnerable firmware version is specifically V4.3.0cu.7570_B20200620; detections should be scoped to devices running this exact build. ↗
- ·The Snort/Suricata rule (sid:2061799) uses a fixed URI bsize of 20 bytes for /cgi-bin/cstecgi.cgi; ensure your IDS/IPS supports the bsize keyword to avoid false negatives.
- ·The parameter name 'ipDoamin' is a typo (not 'ipDomain') as it appears in the actual firmware/CGI handler; signatures must match this misspelled name exactly.
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-84q3-wqp7-r229: TOTOLINK N600R V4
ghsa_unreviewed·2022-03-23
CVE-2022-26187 [CRITICAL] CWE-77 GHSA-84q3-wqp7-r229: TOTOLINK N600R V4
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function.
VulnCheck
totolink n600r_firmware Improper Neutralization of Special Elements used in a Command ('Command Injection')
vulncheck·2022·CVSS 9.8
CVE-2022-26187 [CRITICAL] totolink n600r_firmware Improper Neutralization of Special Elements used in a Command ('Command Injection')
totolink n600r_firmware Improper Neutralization of Special Elements used in a Command ('Command Injection')
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function.
Affected: totolink n600r_firmware
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.fortinet.com/blog/threat-research/new-rust-botnet-rustobot-is-routed-via-routers
Suricata
ET WEB_SPECIFIC_APPS TOTOLINK N600R cstecgi.cgi ipDoamin parameter Command Injection Attempt (CVE-2022-26187)
suricata·2025-04-22·CVSS 9.8
CVE-2022-26187 [CRITICAL] ET WEB_SPECIFIC_APPS TOTOLINK N600R cstecgi.cgi ipDoamin parameter Command Injection Attempt (CVE-2022-26187)
ET WEB_SPECIFIC_APPS TOTOLINK N600R cstecgi.cgi ipDoamin parameter Command Injection Attempt (CVE-2022-26187)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS TOTOLINK N600R cstecgi.cgi ipDoamin parameter Command Injection Attempt (CVE-2022-26187)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:20; content:"/cgi-bin/cstecgi.cgi"; http.request_body; content:"|22|topicurl|22 3a|"; content:"|22|setting/setDiagnosisCfg|22|"; within:30; fast_pattern; content:"|22|ipDoamin|22 3a|"; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,github.com/doudoudedi/TOTOLINK_N600R_Command_Injection/blob/main/TOTOLINK-N600R-Command-Injection.md; reference:cve,2022-26187; classtype:attempted-admin; si
No public exploits indexed.
2022-03-22
Published
Exploited in the wild