Threats tagged 'ghsa-ffcw-mgqm-526x'

A critical command injection vulnerability exists in TOTOLINK A950RG firmware version 4.1.2cu.5268_B20221104. The flaw affects the getDeviceInfo function related to the /var/lib/misc/udhcpd.leases file in the device-information handler. An attacker with high privileges can remotely manipulate the MAC address argument to execute arbitrary commands. Public exploit code is available, increasing the risk of exploitation.