CVE-2023-46415
Published: 25 October 2023
Summary
CVE-2023-46415 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink X6000R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 10.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability CVE-2023-46415 is a remote command execution flaw in the TOTOLINK X6000R router running firmware version v9.4.0cu.652_B20230116. It resides in the sub_41E588 function and stems from improper neutralization of special elements used in a command (CWE-77), allowing unauthenticated network-based interaction.
Attackers with no credentials or user interaction required can send crafted requests over the network to execute arbitrary operating system commands. Successful exploitation grants full control over the device, resulting in high impact to confidentiality, integrity, and availability as reflected in the CVSS 9.8 rating.
The listed references consist of a GitHub technical write-up containing proof-of-concept details and links to the vendor firmware download page, but they contain no explicit statements on patches, workarounds, or mitigation steps. The associated EPSS score has remained flat at 0.0505 with no material rise observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-50634
Vulnerability details
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41E588 function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.