Cyber Resilience

CVE-2023-46370

CriticalPublic PoCRCE

Published: 25 October 2023

Published
25 October 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.5767 98.2th percentile
Risk Priority 54 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-46370 is a critical-severity Command Injection (CWE-77) vulnerability in Tenda W18E Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 1.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

Tenda W18E firmware version V16.01.0.8(1576) contains a command injection vulnerability in the formSetNetCheckTools function that is triggered through the hostName parameter. The issue is tracked as CVE-2023-46370, carries a CVSS 3.1 score of 9.8, and is associated with CWE-77.

An unauthenticated attacker can send a crafted request over the network to execute arbitrary commands on the device, resulting in complete loss of confidentiality, integrity, and availability without any user interaction or privileges. The current and peak EPSS score for the CVE stands at 0.5767.

No vendor advisory or patch information is supplied in the available references.

EU & UK References

Vulnerability details

Tenda W18E V16.01.0.8(1576) has a command injection vulnerability via the hostName parameter in the formSetNetCheckTools function.

CWE(s)
CWE-77

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

tenda
w18e firmware
16.01.0.8\(1576\)

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References