CVE-2021-27710: totolink x5000r firmware +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2021-27710

CVSS 9.8 · Critical EPSS 7,9%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada totolink x5000r firmware, totolink a720r firmware. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system function with untrusted input. In the function, "ip" parameter is directly passed to the attacker, allowing them to control the "ip" field to attack the OS.

Rincian

Terbit di NVD: 14 April 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
EPSS (30 hari): 7,9% peluang dieksploitasi; lebih tinggi dari 94,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
totolink	x5000r firmware	Versi 9.1.0u.6118_b20201102
totolink	a720r firmware	Versi 4.1.5cu.470_b20200911

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://hackmd.io/Hy3oVgtcQiuqAtv9FdylHw exploit · advisory pihak ketiga
https://hackmd.io/KjXzQdjDRjOuRjoZZXQo_A exploit · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.