Critical severity9.8NVD Advisory· Published Mar 23, 2023· Updated Jun 17, 2026

CVE-2022-28491

Description

TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 contains a command injection vulnerability in the NTPSyncWithHost function via the host_name parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

TOTOLINK/outdoor CPE CP900description
Totolink/CPE CP900llm-fuzzy
Range: V6.3c.566_B20171026

Patches

Vulnerability mechanics

References

github.com/B2eFly/CVE/blob/main/totolink/CP900/2/2.mdnvdExploitThird Party Advisory
github.com/B2eFly/Router/blob/main/totolink/CP900/1/2.mdnvdBroken Link

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.004
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000