CVE-2023-46574

Deeper analysis

CVE-2023-46574 is a command-injection vulnerability (CWE-77) affecting the TOTOLINK A3700R wireless router running firmware version 9.1.2u.6165_20211012. The flaw resides in the UploadFirmwareFile function, where the FileName parameter is insufficiently sanitized before being passed to a system command, enabling arbitrary code execution. The issue carries a CVSS 3.1 base score of 9.8 with a network attack vector, low complexity, and no required privileges or user interaction.

An unauthenticated remote attacker can send a crafted HTTP request containing a malicious FileName value to the router’s firmware-upload endpoint. Successful exploitation grants the attacker the ability to execute operating-system commands with the privileges of the web-server process, resulting in complete control over the device, including the capacity to read or modify configuration and firmware data or to pivot into the attached network.

Public references consist of technical write-ups hosted on GitHub that reproduce the flaw but do not describe vendor patches or mitigation steps. The associated EPSS score remains elevated (current 0.9358, peak 0.9402), indicating sustained exploitation interest since disclosure.