CVE-2023-46424
Published: 25 October 2023
Summary
CVE-2023-46424 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink X6000R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 10.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOLINK X6000R firmware version v9.4.0cu.652_B20230116 contains a remote command execution vulnerability in the sub_422BD4 function, tracked as CVE-2023-46424 and assigned CWE-77. The flaw carries a CVSS 3.1 score of 9.8, reflecting network-accessible command injection without any authentication or user interaction required.
An unauthenticated attacker can send crafted requests to the affected device and execute arbitrary operating-system commands, resulting in complete control over the router and its connected network traffic.
Public references include a detailed technical write-up on GitHub and links to TOTOLINK firmware downloads, but no explicit patch or mitigation guidance is provided in the available sources. The associated EPSS score has remained flat at 0.0505 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-50643
Vulnerability details
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_422BD4 function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.