Command Execution Vulnerability in TOTOLINK X6000R Firmware
CVE-2023-48800

9.8CRITICAL

Key Information:

Vendor

Totolink
Status
X6000r Firmware
Vendor
CVE Published:
4 December 2023

What is CVE-2023-48800?

A command execution vulnerability exists in the TOTOLINK X6000R firmware due to improper handling of user input in the shttpd file. The sub_417338 function retrieves parameters from the front-end and uses the snprintf function to format them before passing them to the CsteSystem function, which can lead to unauthorized command execution by attackers. This poses a significant risk as malicious actors could exploit this flaw to gain control of affected devices, potentially compromising network security.

References

https://www.notion.so/X6000R-sub_417338-ad96548d06c645738...
https://palm-jump-676.notion.site/CVE-2023-48800-ad96548d...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.