Remote Code Execution Vulnerability in TOTOLINK X6000R Products
CVE-2023-43453

9.8CRITICAL

Key Information:

Vendor
Totolink
Status
X6000r Firmware
Vendor
CVE Published:
1 December 2023

Summary

A remote code execution vulnerability exists in TOTOLINK X6000R versions V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719. This issue allows an attacker to execute arbitrary code by manipulating the IP parameter of the setDiagnosisCfg component. Users of these devices should implement security best practices to mitigate potential exploits.

References

https://github.com/tharsis1024/vuln/blob/main/TOTOLINK/X6...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.