CVE-2023-27135

Deeper analysis

CVE-2023-27135 is a command injection vulnerability in the TOTOLINK A7100RU wireless router running firmware version V7.4cu.2313_B20191024. The flaw resides in the web management interface at the endpoint /setting/setWanIeCfg, where the “enabled” parameter is processed without adequate sanitization, allowing arbitrary operating-system commands to be executed under the web-server process.

An unauthenticated attacker with network access can supply a crafted HTTP request containing shell metacharacters in the enabled field. Successful exploitation grants the attacker the ability to read, modify, or delete arbitrary files, create new accounts, or pivot further into attached networks, corresponding to the CVSS 9.8 rating that reflects no required credentials or user interaction.

Public references consist of proof-of-concept material hosted on GitHub that demonstrates the injection vector. No vendor advisory or firmware patch is referenced in the available sources.

The EPSS score for this CVE rose from a low baseline to a peak of 0.3113 on 2025-01-22 before receding to the current value of 0.0516, indicating a measurable increase in observed exploitation interest well after the original disclosure.