CVE-2023-26848
Published: 07 April 2023
Summary
CVE-2023-26848 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink A7100Ru Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOlink A7100RU routers running firmware version V7.4cu.2313_B20191024 contain a command injection vulnerability, tracked as CVE-2023-26848 and assigned CWE-77. The flaw resides in the setting/delStaticDhcpRules endpoint and is triggered through the org parameter. It carries a CVSS 3.1 base score of 9.8, reflecting network-accessible exploitation without authentication or user interaction and full impact on confidentiality, integrity, and availability.
Remote attackers can send crafted HTTP requests to the affected endpoint to inject and execute arbitrary operating-system commands on the device. Successful exploitation grants an unauthenticated adversary complete control over the router, enabling actions such as configuration changes, traffic interception, or persistence mechanisms.
Public references consist of proof-of-concept material hosted on GitHub that demonstrates the injection vector; no vendor advisory or firmware patch information is included in the available references. The EPSS score reached a peak of 0.2173 and currently stands at 0.1490, indicating moderate and sustained exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-30640
Vulnerability details
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the org parameter at setting/delStaticDhcpRules.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.