CVE-2023-52031
Published: 11 January 2024
Summary
CVE-2023-52031 is a critical-severity an unspecified weakness vulnerability in Totolink A3700R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOlink A3700R firmware version 9.1.2u.5822_B20200513 contains a remote command execution vulnerability in the UploadFirmwareFile function. The flaw received a CVSS 3.1 score of 9.8 and is tracked under CVE-2023-52031.
An unauthenticated attacker with network access can invoke the affected function to execute arbitrary commands on the device, resulting in full compromise of confidentiality, integrity, and availability. No user interaction or credentials are required.
The two reference URLs both point to the same technical write-up that demonstrates the issue but contain no vendor advisory, patch information, or mitigation guidance. The associated EPSS score has remained flat at 0.1482 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-56710
Vulnerability details
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the UploadFirmwareFile function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.