CVE-2015-9551 An issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B20150707.1612 and F1-V2 through 1.1-B20150708.1646 devices. There is Remote Code Execution in the management interface via the formSysCmd sy...
CriticalCVSS 9.8
EPSS 4.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B20150707.1612 and F1-V2 through 1.1-B20150708.1646 devices. There is Remote Code Execution in the management interface via the formSysCmd sysCmd parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| totolink a850r-v1 firmware | < 1.0.1-b20150707.1612 | 1.0.1-b20150707.1612 |
| totolink f1-v2 firmware | < 2.1.1-b20150708.1646 | 2.1.1-b20150708.1646 |
| totolink f2-v1 firmware | < 2.1.0-b20150320.1611 | 2.1.0-b20150320.1611 |
| totolink n150rt-v2 firmware | < 2.1.1-b20150708.1548 | 2.1.1-b20150708.1548 |
| totolink n151rt-v2 firmware | < 1.1-b20150708.1559 | 1.1-b20150708.1559 |
| totolink n300rh-v2 firmware | < 2.0.1-b20150708.1625 | 2.0.1-b20150708.1625 |
| totolink n300rh-v3 firmware | < 3.0.0-b20150331.0858 | 3.0.0-b20150331.0858 |
| totolink n300rt-v2 firmware | < 2.1.1-b20150708.1613 | 2.1.1-b20150708.1613 |
References
- pierrekim.github.io exploit third-party-advisory