CVE-2023-46416
Published: 25 October 2023
Summary
CVE-2023-46416 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink X6000R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 10.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOLINK X6000R firmware version v9.4.0cu.652_B20230116 contains a remote command execution vulnerability in the sub_41A414 function. The flaw is tracked as CVE-2023-46416 with a CVSS 3.1 score of 9.8 and is categorized under CWE-77 command injection, allowing unauthenticated network attackers to run arbitrary operating-system commands on the device.
An attacker with network access can send specially crafted requests to the affected function without authentication or user interaction, resulting in full control over the router and the ability to read, modify, or delete data as well as disrupt device operation. The EPSS score has remained flat at 0.05 with no observed increase after disclosure.
Public references consist of a technical write-up hosted on GitHub that details the vulnerable function and a TOTOLINK firmware download page; no vendor advisory text describing patches or configuration mitigations is included in the available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-50635
Vulnerability details
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ The 41A414 function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.