CVE-2022-44251 in NR1800X
Summary
by MITRE • 11/23/2022
TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the ussd parameter in the setUssd function.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/26/2025
The TOTOLINK NR1800X router firmware version V9.1.0u.6279_B20210910 contains a critical command injection vulnerability that resides within the setUssd function. This vulnerability specifically manifests through the ussd parameter, which is designed to handle unsolicited service code requests typically used in mobile network communications. The flaw represents a classic command injection weakness where user-supplied input is not properly sanitized or validated before being processed by the underlying system commands. The vulnerability falls under CWE-77 which categorizes improper neutralization of special elements used in commands, making it particularly dangerous as it allows attackers to execute arbitrary commands on the affected device with the privileges of the web server process.
The operational impact of this vulnerability extends beyond simple remote code execution, as it provides attackers with a potential foothold for further exploitation within the network infrastructure. Since the affected device is a router, successful exploitation could enable attackers to gain full administrative control over the network gateway, potentially allowing them to redirect traffic, modify network settings, intercept communications, or establish persistent backdoors. The vulnerability's accessibility through the ussd parameter suggests that it could be triggered via web-based interfaces or API calls, making it particularly attractive to threat actors who may leverage automated scanning tools to identify and exploit vulnerable devices. This type of vulnerability aligns with ATT&CK technique T1059.001 for command and scripting interpreter, where adversaries leverage legitimate system utilities to execute malicious commands.
Mitigation strategies for this vulnerability should include immediate firmware updates from TOTOLINK to address the command injection flaw, along with network segmentation to limit access to administrative interfaces. Organizations should implement strict input validation measures and employ web application firewalls to filter malicious payloads targeting the ussd parameter. Additionally, monitoring network traffic for suspicious command execution patterns and implementing least privilege access controls for router administration can significantly reduce the attack surface. The vulnerability demonstrates the importance of secure coding practices in embedded systems and highlights the need for regular security assessments of network infrastructure devices, particularly those with web-based management interfaces that may be exposed to external threats.