CVE-2023-31531

Deeper analysis

Motorola CX2L Router version 1.0.1 contains a command injection vulnerability (CWE-77) that can be triggered through the tomography_ping_number parameter. The flaw received a CVSS 3.1 base score of 8.8, reflecting network attack vector, low attack complexity, and required low-privileged credentials.

An authenticated remote attacker can supply crafted input to the affected parameter and execute arbitrary operating-system commands on the device, resulting in full control over confidentiality, integrity, and availability of the router.

Public references consist solely of proof-of-concept repositories demonstrating the injection; no vendor advisory, firmware update, or official mitigation guidance is referenced. The associated EPSS score has remained flat at 0.1187 with no material increase since disclosure.