Vulnerability Spotlight: Multiple issues in Robustel R1510 cellular router could lead to code execution, denial of service

Summary: Cisco Talos discovered nine vulnerabilities in the Robustel R1510 industrial cellular router, including five OS command injection flaws triggered by specially crafted network requests, all rated CVSS 9.1 out of 10. Two of those, TALOS-2022-1580 (CVE-2022-34845) and TALOS-2022-1570 (CVE-2022-32585), can also lead to arbitrary code execution when a user is logged in as an administrator, while other flaws allow crashing the web server or removing arbitrary files despite a path traversal check. Talos worked with Robustel on a fix, and versions 3.3.0 and 3.1.16 were tested and confirmed exploitable.
Bottom line: A CVSS 9.1 command injection in a router that shares 3G and 4G links for industrial and IoT environments puts remote code execution one crafted request away, and Talos confirmed the listed firmware versions could be exploited.

Read the original at Cisco Talos ↗

Topics: Endpoint & Network Security
Mentions: CVE-2022-28127 CVE-2022-32585 CVE-2022-34845 CVE-2022-35261 CVE-2022-35271
Related: Vulnerability Spotlight: Command injection vulnerabilities in Robustel cellular router Cyber Risks ·
Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026
Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026