Security Resilience

CVE-2023-52030

Totolink A3700R Firmware 9.1.2u.5822_b20200513

Public PoC
Published
11 January 2024
Modified
14 May 2025
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.015 74th percentile
Risk Priority 82 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-52030 is a critical-severity Execution with Unnecessary Privileges (CWE-250) vulnerability in Totolink A3700R Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 26% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-6 (Least Privilege) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

TOTOlink A3700R firmware version v9.1.2u.5822_B20200513 contains a remote command execution vulnerability in the setOpModeCfg function. The flaw is tracked as CVE-2023-52030 with a CVSS 3.1 score of 9.8, reflecting network attack vector, low attack complexity, and no required privileges or user interaction.

An unauthenticated attacker with network access can invoke the affected function to execute arbitrary operating-system commands on the device. Successful exploitation grants full control over the router, enabling actions such as configuration changes, traffic interception, or use of the device as an internal network foothold.

Public references consist of a technical write-up that demonstrates the vulnerability through the setOpModeCfg endpoint; no vendor advisory or firmware patch information is included in the available sources. The EPSS score stands at 0.1482 with no material increase from its recorded peak.

EU & UK References

Vulnerability Data

TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the setOpModeCfg function.

CWE(s)
NVD-CWE-noinfoCWE-250

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001 Data Obfuscation Command And Control
Adversaries may obfuscate command and control traffic to make it more difficult to detect.
attack.mitre.org →
T1001.001 Junk Data Command And Control
Adversaries may add junk data to protocols used for command and control to make detection more difficult.
attack.mitre.org →
T1007 System Service Discovery Discovery
Adversaries may try to gather information about registered local system services.
attack.mitre.org →
T1011 Exfiltration Over Other Network Medium Exfiltration
Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel.
attack.mitre.org →
T1027.003 Steganography Stealth
Adversaries may use steganography techniques in order to prevent the detection of hidden information.
attack.mitre.org →
T1027.004 Compile After Delivery Stealth
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-3665Same product: Totolink A3700R
CVE-2025-3666Same product: Totolink A3700R
CVE-2025-3667Same product: Totolink A3700R
CVE-2025-3664Same product: Totolink A3700R
CVE-2025-3663Same product: Totolink A3700R
CVE-2025-3668Same product: Totolink A3700R
CVE-2025-3675Same product: Totolink A3700R
CVE-2025-3674Same product: Totolink A3700R
CVE-2026-1143Same product: Totolink A3700R
CVE-2024-42545Same product: Totolink A3700R

Affected Assets

totolink
a3700r firmware
9.1.2u.5822_b20200513

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 4 hardening rules · 4 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V10.2.3
  • V13.2.2

Mitigating Controls (NIST 800-53 r5) AI

AC-6 Least Privilege good match

Least privilege directly requires that only the minimum necessary authorizations are granted, structurally eliminating execution with unnecessary privileges.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
blocks

PR.AA-05 directly enforces least privilege so largely eliminates CWE-250 at design time, yet the weakness can still arise from runtime escalation paths, third-party code, or misapplied role definitions outside this single control.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.14 Information transfer partial match
removes
A.5.15 Access control partial match
blocks

A.5.15's policy, requirements, and rules for determining/minimizing access rights (incl. privileged access restrictions, need-to-know, least-privilege-like mapping, and role-based consistency) directly stop most unnecessary-privilege execution by design; bounded remainder is runtime elevation or misconfigured enforcement that still requires other controls (e.g. 8.2, 8.3) to act.

A.5.16 Identity management partial match
removes
A.5.17 Authentication information partial match
removes
A.5.18 Access rights partial match
blocks

Requiring explicit justification and time-limited grants discourages the routine allocation of unnecessary privileges that would otherwise allow execution with more rights than required.

A.5.35 Independent review of information security partial match
finds

Independent scrutiny can identify processes or services still running with unnecessary privileges and drive their reduction before an attacker can abuse them.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).

Windows 10 (1 rule)
  • V-220712 Only accounts responsible for the administration of a system must have Administrator rights on the system. blocks CWE-250
Windows Server 2016 (1 rule)
  • V-225007 Only administrators responsible for the member server or standalone or nondomain-joined system must have Administrator rights on the system. blocks CWE-250
Windows Server 2019 (1 rule)
  • V-205746 Windows Server 2019 must only allow Administrators responsible for the member server or standalone or nondomain-joined system to have Administrator rights on the system. blocks CWE-250

References