---
# System prepended metadata

title: CVE-2021-46007

---

# CVE-2021-46007
## Command Injection in Totolink A3100R V5.9c.4577 
by KVS

* Description
    The backend of a page is executing the "ping" command, and the input field does not adequately filter special symbols. This can lead to command injection attacks.

* Affected version 
	Totolink A3100R V5.9c.4577

* Root Cause Analysis 
It seems that all special symbols are not checked

* Proof-of-Concept
{%youtube oKGExokqQqc %}
