CVE-2023-37149

Deeper analysis

TOTOLINK LR350 firmware version V9.3.5u.6369_B20220309 contains a command injection vulnerability in the setUploadSetting function, where the FileName parameter is not properly sanitized before being passed to a system command. The flaw is tracked as CWE-77 and carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation without authentication or user interaction.

An unauthenticated attacker with network access can supply a crafted FileName value to the affected endpoint, resulting in arbitrary command execution on the device. Successful exploitation grants the attacker full control over the router, including the ability to read or modify configuration data, install persistent malware, or pivot into attached networks.

Public references consist of technical write-ups hosted on GitHub that detail the vulnerable function and parameter but contain no information on vendor patches or mitigation steps. The EPSS score rose from a low baseline to a peak of 0.2744 on 2025-01-22 before receding to the current value of 0.0140, indicating a clear increase in exploitation interest well after the 2023 disclosure.