Vulnerability · Published Apr 14, 2021 · Assigned by mitre

CVE-2021-27710

Critical 9.8

In plain English

A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.9% (higher than 95% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)7.9%top 5.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system function with untrusted input. In the function, "ip" parameter is directly passed to the attacker, allowing them to control the "ip" field to attack the OS.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://hackmd.io/KjXzQdjDRjOuRjoZZXQo_A x_refsource_MISC
https://hackmd.io/Hy3oVgtcQiuqAtv9FdylHw x_refsource_MISC