CVE-2023-29803

Deeper analysis

TOTOLINK X18 firmware version V9.1.0cu.2024_B20220329 contains a command injection vulnerability (CWE-77) in the disconnectVPN function, where the pid parameter is not properly sanitized before being passed to a system command. The flaw received a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation with no required authentication or user interaction and full impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can supply a malicious pid value to the affected endpoint and execute arbitrary operating-system commands on the device. Successful exploitation grants complete control over the router, enabling actions such as credential theft, traffic interception, persistence, or use as an internal network pivot.

Public references consist of technical write-ups hosted on Notion that demonstrate the injection vector; no vendor advisory, firmware patch, or official mitigation guidance appears among the provided sources. The EPSS score rose from a low baseline to a peak of 0.2264, indicating measurable post-disclosure exploitation interest that warrants renewed monitoring.