CVE-2018-20841: HooToo TripMate Titan routers allow OS command injection via mac parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, public exploit code available, and a very high EPSS score make this an urgent exposure for any internet- or LAN-reachable device.

What it is

HooToo TripMate Titan HT-TM05 and HT-05 routers running firmware 2.000.022 and 2.000.082 pass the mac parameter of a protocol.csp set/security/mac_table request into a shell without sanitization, allowing OS command injection. Because the request is reachable over the network with no authentication, an unauthenticated attacker can execute arbitrary commands on the device.

Impact

An attacker gains remote command execution with the privileges of the router's web service, enabling full compromise of the device, including configuration changes, credential theft, and use as a pivot into the local network.

Attack surface

Reached over the network via an HTTP request to protocol.csp?function=set&fname=security&opt=mac_table with shell metacharacters in the mac parameter. The CVSS vector indicates no privileges and no user interaction are required.

Exploitation

Public exploit code exists (Exploit-DB 46143 and the IOActive advisory are tagged Exploit), and EPSS is 0.479 (98.8th percentile), though the CVE is not listed in CISA KEV.

What to do

• Apply the vendor firmware update if one is available; the record does not name a fixed version, so confirm with HooToo.
• If no patch exists, isolate affected routers on a segmented network and block untrusted access to the web management interface.
• Restrict the router's HTTP management interface to trusted administrative hosts only, and disable remote/WAN administration.
• Replace end-of-life TripMate Titan units that no longer receive firmware support.
• Monitor the device for unexpected outbound connections or processes that would indicate command execution.

Detection

• Inspect HTTP request logs for protocol.csp requests with function=set&fname=security&opt=mac_table containing shell metacharacters (;, |, $(), backticks) in the mac parameter.
• Alert on unexpected processes or outbound connections originating from the router's management service.
• Monitor for repeated or anomalous requests to the router's web interface from untrusted network segments.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.