CVE-2022-25075

What it actually does

This is an unauthenticated remote command injection vulnerability in TOTOLink A3000RU firmware V5.9c.2280_B20180512. The vulnerable Main function processes attacker-controlled data from the HTTP QUERY_STRING parameter without safely validating or escaping shell metacharacters. A remote attacker who can reach the router's web management interface can inject operating-system commands that execute with the privileges of the router web service, potentially allowing full device compromise, configuration theft, traffic interception, malware installation, botnet enrollment, or service disruption.

Why it matters to the business

Compromise of an edge router can give an attacker control over network ingress and egress traffic, enabling outages, credential theft, redirection of users to malicious sites, internal network reconnaissance, and persistent foothold creation. Because the flaw is remotely exploitable without authentication, has public exploit availability, and has a high EPSS score indicating meaningful exploitation likelihood, exposed devices should be treated as high-priority remediation targets even though it is not currently listed in CISA KEV. No fixed version was provided in the supplied data, so organizations may need to remove exposure, replace the device, or obtain updated firmware directly from the vendor.

How an attack unfolds

An attacker first identifies an internet-facing or otherwise reachable TOTOLink A3000RU web administration interface running the affected firmware. They send a crafted HTTP request that places shell syntax or command separators in the query string processed by the vulnerable Main function. Because the firmware passes this value into a command execution context without adequate sanitization, the router executes attacker-supplied commands. The attacker typically begins with simple proof-of-execution commands, then retrieves additional tooling using utilities such as wget, curl, tftp, or busybox. After successful execution, they may create persistence where possible, modify DNS or routing settings, dump configuration files, disable services, proxy traffic, or install botnet malware commonly targeting embedded Linux routers.

How to fix it

Upgrade the TOTOLink A3000RU firmware to a vendor-provided version that explicitly fixes this vulnerability if one is available. The supplied fixed-version data does not list a patched release, so if no confirmed fixed firmware is available, replace the affected device or remove it from service. Immediately disable internet exposure of the router management interface, restrict administration to a trusted management network or VPN, and block untrusted access to HTTP/HTTPS management ports at upstream firewalls. Change router administrative credentials after remediation, review DNS, port forwarding, VPN, and remote management settings for unauthorized changes, and perform a factory reset followed by secure reconfiguration if compromise is suspected. Where replacement is not immediately possible, use compensating controls such as management ACLs, WAN-side administration disabled, network segmentation, and external attack-surface monitoring.

How to confirm the fix worked

Confirm the device model and firmware version through the administrative interface, vendor tooling, or configuration backup and verify that V5.9c.2280_B20180512 is no longer deployed. Validate that the management interface is not reachable from the public internet or other untrusted networks by scanning from an external vantage point. Review firewall rules to ensure only trusted management sources can reach router administration ports. If upgraded, confirm the running firmware version after reboot and test that crafted query strings containing shell metacharacters are rejected, sanitized, or produce no command execution. For suspected compromise, compare configuration against a known-good baseline, verify DNS and routing settings, check for unexpected startup entries or binaries if shell access is available, and monitor for outbound connections to unknown hosts.

Typical attack path

1. Scan for reachable TOTOLink A3000RU web management interfaces on HTTP or HTTPS ports.
2. Fingerprint the device model or firmware version using web headers, login pages, static resources, or known endpoint behavior.
3. Send a crafted HTTP request containing command-injection metacharacters in the QUERY_STRING parameter handled by the Main function.
4. Verify command execution using network callbacks, timing delays, file writes, or command output in the HTTP response.
5. Download and execute additional payloads using built-in router utilities such as wget, curl, tftp, ftpget, or busybox.
6. Modify router configuration, deploy malware, pivot toward internal systems, intercept traffic, or disrupt availability.

How to detect it

Look for evidence of crafted HTTP requests to the router management interface where the query string contains shell metacharacters, command separators, encoded command syntax, or download-and-execute payloads. Useful sources include router web administration logs if available, upstream firewall logs, reverse proxy logs if the interface is proxied, IDS/IPS alerts, NetFlow, DNS logs, and packet captures. Search for requests containing characters and encodings such as semicolon, pipe, backtick, $(), %3b, %7c, %60, or %24%28 followed by Linux commands. Pay particular attention to payloads invoking wget, curl, tftp, ftpget, busybox, sh, chmod, nc, telnetd, rm, or commands that contact external infrastructure. Post-exploitation signs include unexpected outbound HTTP/TFTP/FTP connections from the router, sudden scanning traffic from the device, unauthorized DNS or gateway changes, new port-forwarding rules, disabled security settings, changed admin credentials, unexplained reboots, or router participation in botnet-like traffic. Because embedded-router logging is often limited, absence of device logs should not be treated as proof of non-exploitation; use upstream network telemetry and configuration review as primary evidence sources.

• QUERY_STRING=.*;.*
• QUERY_STRING=.*|.*
• QUERY_STRING=.*`.*`.*
• QUERY_STRING=.*\$\(.*\).*
• %3bwget
• %3Bwget
• %3bcurl
• %3Bcurl
• %7cwget
• %7Cwget
• %7ccurl
• %7Ccurl
• %60wget
• %60curl
• $(wget
• $(curl
• ;wget
• ; wget
• ;curl
• ; curl
• |wget
• | wget
• |curl
• | curl
• ;busybox
• |busybox
• ;chmod +x
• |chmod +x
• /bin/sh -c
• /bin/busybox
• tftp -g
• ftpget
• telnetd -p
• nc -e
• /cgi-bin/.*\?.*;
• /cgi-bin/.*\?.*%3b
• /cgi-bin/.*\?.*%7c
• /cgi-bin/.*\?.*%60

What your security team should do

• Treat externally exposed TOTOLink A3000RU devices running the affected firmware as urgent remediation items due to unauthenticated remote code execution, public exploit availability, and high EPSS likelihood.
• Inventory all TOTOLink A3000RU devices, including branch, lab, remote-office, and spare devices, and identify any running firmware V5.9c.2280_B20180512.
• Disable WAN-side or untrusted-network access to the web management interface immediately while remediation or replacement is planned.
• Apply a vendor-confirmed fixed firmware release if available; if no fixed release can be confirmed, replace the device with a supported model.
• Rotate router administrative credentials and review configuration for unauthorized DNS, routing, port-forwarding, VPN, or remote-management changes.
• Hunt web access logs, firewall logs, IDS alerts, and network telemetry for command-injection attempts containing shell metacharacters and payload download commands in query strings.
• Monitor affected network segments for outbound connections from routers to unfamiliar IPs, especially HTTP, HTTPS, TFTP, FTP, IRC, Telnet, or high-volume scanning behavior.
• If exploitation is suspected, isolate the device, preserve logs/configuration where possible, factory reset or replace it, and reconfigure from a trusted baseline rather than reusing a potentially compromised backup.