CVE-2023-26978
Published: 07 April 2023
Summary
CVE-2023-26978 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink A7100Ru Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOlink A7100RU routers running firmware version V7.4cu.2313_B20191024 contain a command injection vulnerability in the pppoeAcName parameter processed by the /setting/setWanIeCfg endpoint. The flaw is tracked as CVE-2023-26978, carries a CVSS v3.1 score of 9.8, and is classified under CWE-77.
Unauthenticated attackers with network access can supply crafted input to the affected parameter and execute arbitrary operating-system commands on the device. Successful exploitation grants full control over the router, including the ability to read or modify configuration data, intercept traffic, or pivot into attached networks.
Public proof-of-concept material has been posted to GitHub, and the CVE’s EPSS score rose from lower values to a peak of 0.2173 before settling at 0.1490. This trajectory indicates that exploitation interest increased after disclosure and suggests the issue merits renewed attention from defenders. No vendor advisory or patch information appears in the available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-30768
Vulnerability details
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pppoeAcName parameter at /setting/setWanIeCfg.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.