Cyber Resilience

CVE-2023-46416

CriticalPublic PoCRCE

Published: 25 October 2023

Published
25 October 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0505 90.0th percentile
Risk Priority 23 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-46416 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink X6000R Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 10.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

TOTOLINK X6000R firmware version v9.4.0cu.652_B20230116 contains a remote command execution vulnerability in the sub_41A414 function. The flaw is tracked as CVE-2023-46416 with a CVSS 3.1 score of 9.8 and is categorized under CWE-77 command injection, allowing unauthenticated network attackers to run arbitrary operating-system commands on the device.

An attacker with network access can send specially crafted requests to the affected function without authentication or user interaction, resulting in full control over the router and the ability to read, modify, or delete data as well as disrupt device operation. The EPSS score has remained flat at 0.05 with no observed increase after disclosure.

Public references consist of a technical write-up hosted on GitHub that details the vulnerable function and a TOTOLINK firmware download page; no vendor advisory text describing patches or configuration mitigations is included in the available references.

EU & UK References

Vulnerability details

TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ The 41A414 function.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

totolink
x6000r firmware
9.4.0cu.652_b20230116

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References