CVE-2023-46979
Published: 31 October 2023
Summary
CVE-2023-46979 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink X6000R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 12.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOLINK X6000R firmware version V9.4.0cu.852_B20230719 contains a command injection vulnerability in the setLedCfg function, specifically through the enable parameter. The flaw is tracked as CVE-2023-46979 with CWE-77 and carries a CVSS 3.1 score of 9.8, reflecting network attack vector, low complexity, and no required authentication or user interaction.
An unauthenticated remote attacker can supply crafted input to the affected parameter and execute arbitrary operating-system commands on the device. Successful exploitation grants full control over the router, allowing confidentiality, integrity, and availability impacts.
Public references consist of detailed vulnerability reports hosted on GitHub that document the injection point and reproduction steps; no vendor advisory or official patch information is included in the supplied references.
EPSS for the CVE rose from a low baseline to a peak of 0.5106 on 2025-01-22 before receding to the current value of 0.0324, indicating a clear post-disclosure increase in exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-51137
Vulnerability details
TOTOLINK X6000R V9.4.0cu.852_B20230719 was discovered to contain a command injection vulnerability via the enable parameter in the setLedCfg function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.