CVE-2020-25499 Command injection in n/a
Authenticated attackers can execute arbitrary OS commands on TOTOLINK routers by modifying the Run Command setting.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-25499?
CVE-2020-25499 is a high-severity command injection vulnerability in Totolink A3002r Firmware, published on 9 Dec 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execute arbitrary OS commands on the router.
Which versions are affected by CVE-2020-25499?
It affects 13 products.
Products include Totolink A3002r Firmware, Totolink A3002ru-V1 Firmware, Totolink A3002ru-V2 Firmware, Totolink A702r-V2 Firmware, Totolink A702r-V3 Firmware, Totolink N100re-V3 Firmware and 7 more.
How do I fix CVE-2020-25499?
No fix has been published for CVE-2020-25499 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-25499 being exploited?
There is no known exploitation of CVE-2020-25499 in the wild and no public exploit code.
Other vulnerabilities in Totolink A3002r Firmware
Sources
Also known as GHSA-g4mx-vhr8-g9g7.