CVE-2023-37145

Deeper analysis

TOTOLINK LR350 routers running firmware version V9.3.5u.6369_B20220309 contain a command-injection flaw in the setOpModeCfg function. The vulnerability is triggered when an attacker supplies a crafted hostname parameter, allowing arbitrary operating-system commands to be executed on the device. The issue is tracked as CVE-2023-37145 and carries a CVSS 3.1 base score of 9.8.

Because the flaw is reachable over the network without authentication or user interaction, any remote attacker can exploit it to obtain full control of the router. Successful exploitation grants the ability to read, modify, or delete data and to alter device configuration or firmware, corresponding to complete impacts on confidentiality, integrity, and availability.

Public references consist of technical write-ups hosted on GitHub that document the injection vector; no vendor advisory or firmware patch is referenced in the available sources. The EPSS score rose sharply from a low baseline to a peak of 0.2744 in January 2025 before receding to its current value of 0.0140, indicating a period of increased exploitation interest well after the original disclosure.