CVE-2023-29799

Deeper analysis

CVE-2023-29799 is a command-injection flaw (CWE-77) in the TOTOLINK X18 wireless router running firmware version V9.1.0cu.2024_B20220329. The vulnerability resides in the setOpModeCfg function, where the hostname parameter is passed to a system command without adequate sanitization, allowing arbitrary command execution.

An unauthenticated attacker can exploit the issue over the network by sending a crafted HTTP request containing shell metacharacters in the hostname field. Successful exploitation grants the attacker full control of the device, enabling actions such as configuration changes, traffic interception, or use of the router as a foothold for further attacks inside the local network. The CVSS 3.1 base score of 9.8 reflects the absence of required authentication or user interaction.

The associated EPSS score rose from a low baseline to a peak of 0.2264 before settling at the current value of 0.1490, indicating that exploitation interest increased measurably after public disclosure and that the vulnerability merits renewed attention.