CVE-2023-46422
Published: 25 October 2023
Summary
CVE-2023-46422 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink X6000R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 10.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOLINK X6000R firmware version 9.4.0cu.652_B20230116 contains a remote command execution vulnerability in the sub_411994 function. The flaw is tracked as CVE-2023-46422 with a CVSS 3.1 score of 9.8 and is classified under CWE-77, indicating improper neutralization of special elements used in a command. The affected device is a Wi-Fi 6 router, and the vulnerability permits unauthenticated attackers to inject and execute arbitrary operating-system commands over the network.
An attacker with network access can send specially crafted requests that reach sub_411994 without authentication or user interaction, resulting in full control over the device. Successful exploitation grants the ability to read, modify, or delete data, alter device configuration, or use the router as a foothold for further attacks on connected networks.
The two reference URLs point to a detailed technical write-up on GitHub and the vendor’s firmware download page; neither source describes an official patch or mitigation steps. The associated EPSS score has remained flat at 0.0505 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-50641
Vulnerability details
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411994 function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.