CVE-2023-52027
Published: 11 January 2024
Summary
CVE-2023-52027 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink A3700R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOlink A3700R firmware version 9.1.2u.5822_B20200513 contains a command injection vulnerability in the NTPSyncWithHost function, tracked as CVE-2023-52027 and assigned CWE-77. The flaw permits unauthenticated remote command execution and carries a CVSS 3.1 score of 9.8, reflecting network attack vector, low complexity, and full impact on confidentiality, integrity, and availability.
An attacker with network access to the device can supply crafted input to the affected NTP synchronization handler and execute arbitrary operating-system commands without authentication or user interaction. Successful exploitation grants complete control over the router, enabling actions such as configuration changes, traffic interception, or use of the device as an attack pivot.
Public disclosure references detail the vulnerability but do not describe vendor patches or official mitigation steps. The associated EPSS score has remained flat at 0.1549 with no observed rise after publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-56706
Vulnerability details
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the NTPSyncWithHost function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.