CVE-2023-46976

Deeper analysis

TOTOLINK A3300R firmware version 17.0.0cu.557_B20221024 is affected by a command injection vulnerability tracked as CVE-2023-46976. The flaw resides in the UploadFirmwareFile function, where the file_name parameter is processed without adequate sanitization, corresponding to CWE-77. The issue carries a CVSS 3.1 score of 9.8, reflecting network-accessible attack vectors that require no authentication or user interaction.

An unauthenticated remote attacker can supply a crafted file_name value to the affected endpoint and execute arbitrary operating-system commands on the device. Successful exploitation grants full control over the router, enabling confidentiality, integrity, and availability impacts that include configuration changes, traffic interception, or persistent compromise of the network.

The associated EPSS score started low after the October 2023 disclosure, rose sharply to a peak of 0.5106 on 2025-01-22, and has since receded to 0.0299, indicating a period of heightened exploitation interest that later subsided. Public technical reports detailing the vulnerability are available but do not describe vendor patches or official mitigation steps.