Command Execution Vulnerability in TOTOLINK X6000R Firmware
CVE-2023-48801

9.8CRITICAL

Key Information:

Vendor
Totolink
Status
X6000r Firmware
Vendor
CVE Published:
1 December 2023

Summary

In certain versions of the TOTOLINK X6000R firmware, a vulnerability exists in the shttpd file, specifically in the sub_415534 function. This function improperly handles input fields retrieved from the front-end, concatenating them using the snprintf function without adequate sanitization. Consequently, this flaw allows for arbitrary command execution via the CsteSystem function, posing a significant security risk to affected systems.

References

https://www.notion.so/X6000R-sub_415534-40d4553fc7a649fe8...
https://palm-jump-676.notion.site/CVE-2023-48801-40d4553f...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.