CVE-2023-46993
Published: 31 October 2023
Summary
CVE-2023-46993 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink A3300R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 13.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-46993 is a command-injection vulnerability (CWE-77) affecting the TOTOLINK A3300R wireless router running firmware version V17.0.0cu.557_B20221024. The flaw exists in the handling of the setLedCfg request, where the enable parameter is accepted without any input validation or sanitization, allowing an attacker to inject arbitrary operating-system commands.
An unauthenticated attacker with network access can send a specially crafted HTTP request to the device’s web-management interface and obtain full control of the router. Successful exploitation yields complete confidentiality, integrity, and availability impact, consistent with the CVSS 9.8 rating that reflects no required privileges or user interaction.
Public references consist of a detailed technical report and proof-of-concept hosted on GitHub; no vendor advisory or official patch information is included in the supplied references. The EPSS score rose sharply from a low baseline to a peak of 0.51 in January 2025 before receding, indicating a clear increase in exploitation interest well after the October 2023 disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-51151
Vulnerability details
In TOTOLINK A3300R V17.0.0cu.557_B20221024 when dealing with setLedCfg request, there is no verification for the enable parameter, which can lead to command injection.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.