CVE-2023-46414
Published: 25 October 2023
Summary
CVE-2023-46414 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink X6000R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 10.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOLINK X6000R firmware version 9.4.0cu.652_B20230116 contains a remote command execution vulnerability in the sub_41D494 function. The flaw is tracked as CVE-2023-46414, carries a CVSS 3.1 score of 9.8, and is classified under CWE-77 as command injection. The affected component is exposed to the network and requires no authentication or user interaction to trigger.
An unauthenticated attacker with network access can supply crafted input to the vulnerable function and execute arbitrary operating-system commands on the device. Successful exploitation grants full control over the router, allowing an adversary to read or modify configuration, intercept traffic, or pivot into the attached network.
Public references consist of a detailed technical write-up and proof-of-concept on GitHub together with the vendor’s firmware download page; no explicit patch or advisory statement is included in the available references. The associated EPSS score has remained flat at 0.0505 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-50633
Vulnerability details
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ 41D494 function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.