CVE-2021-44620
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk71th percentile - higher than 71% of all known CVEs
Summary
A command injection vulnerability exists in TOTOLINK A3100R up to version V4.1.2cu.5050_B20200504 in the adm/ntm.asp script via the hosTime parameter. It allows a remote attacker to execute arbitrary system commands on the device.
Risk Assessment
An attacker can gain full control over the router, modify its configuration, intercept network traffic, or use it as a pivot point for further attacks within the internal network.
Recommendation
Immediately update the firmware of the TOTOLINK A3100R device to the latest available version that fixes this vulnerability. If no update is available, restrict administrative panel access to trusted IP addresses only.
Original NVD description (English source)
A Command Injection vulnerability exits in TOTOLINK A3100R <=V4.1.2cu.5050_B20200504 in adm/ntm.asp via the hosTime parameters.