CVE-2023-25395

Deeper analysis

TOTOlink A7100RU V7.4cu.2313_B20191024 routers contain a command-injection flaw (CWE-78) at the /setting/delStaticDhcpRules endpoint. The vulnerability is triggered when an attacker supplies a crafted ou parameter; the value is concatenated into an operating-system command without sanitization, allowing arbitrary command execution. The issue received a CVSS 3.1 score of 9.8, reflecting network access, no required credentials, and full impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can send a single HTTP request containing shell metacharacters in the ou field to execute commands under the router’s web-server context. Successful exploitation grants the attacker the ability to read or modify configuration files, add persistent routes, or pivot into the attached LAN, effectively compromising both the device and any connected clients.

Public references consist solely of a GitHub repository that demonstrates the injection vector; no vendor advisory, firmware update, or mitigation guidance is referenced. The associated EPSS score has remained flat at 0.0519 with no material increase since disclosure, indicating limited observed exploitation interest to date.