CVE-2023-33556

Deeper analysis

TOTOLink A7100RU running firmware version V7.4cu.2313_B20191024 contains a command injection vulnerability in the web management interface. The flaw is triggered by unsanitized input to the staticGw parameter at the /setting/setWanIeCfg endpoint and is tracked as CWE-77. It received a CVSS 3.1 score of 9.8, reflecting network attack vector, low complexity, and no required authentication or user interaction.

An unauthenticated attacker with network access can supply a crafted staticGw value to execute arbitrary operating-system commands on the device. Successful exploitation grants the attacker full control over the router, including the ability to read or modify configuration and data, install persistent malware, or use the device as a pivot point inside the target network.

The EPSS score for this CVE rose from a low baseline to a peak of 0.2264 on 2025-01-22 before receding to the current value of 0.0519. This trajectory indicates that exploitation interest emerged well after the original disclosure date. Public references consist of proof-of-concept material hosted on GitHub but contain no vendor advisory or patch information.