CVE-2021-46007
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk83th percentile - higher than 83% of all known CVEs
Summary
The Totolink A3100R router with firmware version V5.9c.4577 is vulnerable to OS command injection. The ping function in the admin panel does not properly filter special characters, allowing an attacker to execute arbitrary commands.
Risk Assessment
An attacker can gain full control over the router, modify its configuration, intercept network traffic, or use it as a pivot point for further attacks within the internal network.
Recommendation
Immediately update the router firmware to the latest available version or apply temporary mitigations such as restricting access to the admin panel to trusted IP addresses only.
Original NVD description (English source)
totolink a3100r V5.9c.4577 is vulnerable to os command injection. The backend of a page is executing the "ping" command, and the input field does not adequately filter special symbols. This can lead to command injection attacks.