CVE-2015-9551

An issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B20150707.1612 and F1-V2 through 1.1-B20150708.1646 devices. There is Remote Code Execution in the management interface via the formSysCmd sysCmd parameter.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2020-11-24

Last modified

2024-08-06

Affected products

• A850r-v1 Firmware (Totolink)
• F1-v2 Firmware (Totolink)
• F2-v1 Firmware (Totolink)
• N150rt-v2 Firmware (Totolink)
• N151rt-v2 Firmware (Totolink)
• N300rh-v2 Firmware (Totolink)
• N300rh-v3 Firmware (Totolink)
• N300rt-v2 Firmware (Totolink)

References

• https://pierrekim.github.io/blog/2015-07-16-backdoor-and-RCE-found-in-8-TOTOLINK-products.html