CVE-2023-36954

Deeper analysis

TOTOLINK CP300+ routers running firmware V5.2cu.7594_B20200910 and earlier contain a command-injection vulnerability tracked as CVE-2023-36954. The flaw is classified under CWE-77 and carries a CVSS 3.1 base score of 9.8, reflecting a network-accessible vector that requires neither authentication nor user interaction and yields complete confidentiality, integrity, and availability impact on the affected device.

An unauthenticated remote attacker can supply crafted input that is passed directly to a system shell, allowing arbitrary command execution. Successful exploitation grants the attacker full control of the router, enabling actions such as credential theft, traffic interception, persistence mechanisms, or use of the device as an entry point into attached networks.

EPSS for the CVE rose sharply from a low baseline to a peak of 0.5106 on 2025-01-22 before receding to its current value of 0.0336, indicating a distinct period of increased exploitation interest well after the original disclosure. No vendor advisory or patch information is provided in the available references.