CVE-2023-52028

Deeper analysis

TOTOlink A3700R firmware version 9.1.2u.5822_B20200513 contains a remote command execution vulnerability in the setTracerouteCfg function. The flaw is an instance of OS command injection (CWE-78) that permits unauthenticated attackers to supply crafted input leading to arbitrary command execution on the device. It carries a CVSS 3.1 base score of 9.8, reflecting network attack vector, low complexity, and no required privileges or user interaction.

An attacker with network reachability to the router can invoke setTracerouteCfg over the web interface or related endpoints and execute operating-system commands with the privileges of the web server process. Successful exploitation yields full control over the device, enabling actions such as configuration changes, traffic interception, persistence, or use as an internal network pivot.

The associated EPSS score stands at 0.2055 with an identical recorded peak, indicating sustained but not sharply increasing exploitation interest since disclosure. Public technical write-ups detail the injection vector but provide no information on vendor patches or official mitigation steps.