Cyber Resilience

CVE-2023-26978

CriticalPublic PoCRCE

Published: 07 April 2023

Published
07 April 2023
Modified
12 February 2025
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1490 94.7th percentile
Risk Priority 29 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-26978 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink A7100Ru Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 5.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

TOTOlink A7100RU routers running firmware version V7.4cu.2313_B20191024 contain a command injection vulnerability in the pppoeAcName parameter processed by the /setting/setWanIeCfg endpoint. The flaw is tracked as CVE-2023-26978, carries a CVSS v3.1 score of 9.8, and is classified under CWE-77.

Unauthenticated attackers with network access can supply crafted input to the affected parameter and execute arbitrary operating-system commands on the device. Successful exploitation grants full control over the router, including the ability to read or modify configuration data, intercept traffic, or pivot into attached networks.

Public proof-of-concept material has been posted to GitHub, and the CVE’s EPSS score rose from lower values to a peak of 0.2173 before settling at 0.1490. This trajectory indicates that exploitation interest increased after disclosure and suggests the issue merits renewed attention from defenders. No vendor advisory or patch information appears in the available references.

EU & UK References

Vulnerability details

TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pppoeAcName parameter at /setting/setWanIeCfg.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

totolink
a7100ru firmware
7.4cu.2313_b20191024

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References