CVE-2023-46418
Published: 25 October 2023
Summary
CVE-2023-46418 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink X6000R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 10.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOLINK X6000R firmware version 9.4.0cu.652_B20230116 contains a remote command execution vulnerability in the sub_412688 function. The issue is tracked as CVE-2023-46418, carries a CVSS 3.1 score of 9.8, and is associated with CWE-77 improper neutralization of special elements used in a command.
Unauthenticated attackers with network access can invoke the affected function to execute arbitrary commands on the device, resulting in full control over confidentiality, integrity, and availability without any user interaction or credentials.
The listed references include the vendor’s firmware download page and a public technical write-up that reproduces the flaw; administrators should obtain and apply any updated firmware images made available by TOTOLINK through that channel.
The associated EPSS score has remained flat at 0.0505 with no material rise since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-50637
Vulnerability details
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_412688 function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.