CVE-2023-37146

Deeper analysis

TOTOLINK LR350 firmware version V9.3.5u.6369_B20220309 contains a command injection vulnerability in the UploadFirmwareFile function, where the FileName parameter is processed without adequate sanitization. The flaw is classified under CWE-77 and carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation with no required credentials or user interaction and full impact on confidentiality, integrity, and availability.

An unauthenticated attacker with network access can supply a crafted FileName value during firmware upload to inject and execute arbitrary operating-system commands on the device. Successful exploitation grants the attacker complete control over the router, enabling actions such as configuration changes, traffic interception, or persistence mechanisms.

Public references consist of GitHub repositories that document the vulnerability details and proof-of-concept inputs, but they contain no vendor advisory, firmware patch, or official mitigation guidance.

The EPSS score rose from a low baseline to a peak of 0.2744 on 2025-01-22 before receding to the current value of 0.0140, indicating a period of increased exploitation interest that emerged well after the 2023 disclosure.