CVE-2023-46420
Published: 25 October 2023
Summary
CVE-2023-46420 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink X6000R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 10.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOLINK X6000R firmware version 9.4.0cu.652_B20230116 contains a remote command execution vulnerability in the sub_41590C function. The flaw is tracked as CVE-2023-46420, assigned CWE-77 for command injection, and carries a CVSS 3.1 base score of 9.8 reflecting network attack vector, low complexity, and no required privileges or user interaction.
An unauthenticated remote attacker can send crafted requests that reach the affected function and execute arbitrary operating-system commands on the device. Successful exploitation grants full control over confidentiality, integrity, and availability of the router.
The EPSS score has remained flat at 0.0505 with no material rise after disclosure. Public references consist of a GitHub technical write-up demonstrating the issue and links to the vendor’s firmware download page, but no explicit mitigation guidance or patch status is detailed in the available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-50639
Vulnerability details
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41590C function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.