CVE-2023-39618
Published: 21 August 2023
Summary
CVE-2023-39618 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink X5000R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 7.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOLINK X5000R firmware version B20210419 contains a remote code execution vulnerability in the setTracerouteCfg interface. The flaw is tracked as CVE-2023-39618 with a CVSS 3.1 score of 9.8 and is associated with CWE-77, indicating improper neutralization of special elements in a command.
Unauthenticated attackers with network access can supply crafted input to the affected interface and execute arbitrary commands on the device, resulting in complete compromise of confidentiality, integrity, and availability without any user interaction.
The two reference URLs both point to the same Notion page that appears to contain technical details of the issue; no vendor advisory or patch information is supplied in the available data. The EPSS score has remained flat at 0.0784 from disclosure through the present measurement.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-43327
Vulnerability details
TOTOLINK X5000R B20210419 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg interface.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.