CVE-2023-46419
Published: 25 October 2023
Summary
CVE-2023-46419 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink X6000R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 10.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOLINK X6000R firmware version 9.4.0cu.652_B20230116 contains a remote command execution vulnerability in the sub_415730 function. The issue is tracked as CVE-2023-46419 with a CVSS 3.1 score of 9.8 and is classified under CWE-77, indicating improper neutralization of special elements used in a command.
The vulnerability can be exploited by any remote attacker over the network without authentication or user interaction. Successful exploitation grants complete control over the device, allowing arbitrary command execution that can result in full confidentiality, integrity, and availability impacts on the affected router.
The listed references include a TOTOLINK firmware download page and a GitHub repository containing technical details of the flaw; administrators should consult the vendor site for any available firmware updates. The associated EPSS score has remained flat at 0.0505 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-50638
Vulnerability details
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415730 function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.