CVSS: 9.8EPSS: 8%CPEs: 2EXPL: 1CVE-2023-52041
https://notcve.org/view.php?id=CVE-2023-52041
An issue discovered in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary code via the sub_410118 function of the shttpd program. Un problema descubierto en TOTOLINK X6000R V9.4.0cu.852_B20230719 permite a atacantes ejecutar código arbitrario a través de la función sub_410118 del programa shttpd. • https://kee02p.github.io/2024/01/13/CVE-2023-52041 •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-50651
https://notcve.org/view.php?id=CVE-2023-50651
TOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/cstecgi.cgi. Se descubrió que TOTOLINK X6000R v9.4.0cu.852_B20230719 contiene una vulnerabilidad de ejecución remota de comandos (RCE) a través del componente /cgi-bin/cstecgi.cgi. • http://totolink.com https://palm-jump-676.notion.site/X6000R-sub_4119A0-11-b35b4ca36ce84e07afff85c98414d293 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 2CVE-2023-48799
https://notcve.org/view.php?id=CVE-2023-48799
TOTOLINK-X6000R Firmware-V9.4.0cu.852_B20230719 is vulnerable to Command Execution. TOTOLINK-X6000R Firmware-V9.4.0cu.852_B20230719 es vulnerable a la ejecución de comandos. • https://palm-jump-676.notion.site/CVE-2023-48799-632dd667b4574a2c84b04035d04afb5c https://www.notion.so/X6000R-632dd667b4574a2c84b04035d04afb5c?pvs=4 •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 2CVE-2023-48800
https://notcve.org/view.php?id=CVE-2023-48800
In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_417338 function obtains fields from the front-end, connects them through the snprintf function, and passes them to the CsteSystem function, resulting in a command execution vulnerability. En TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, la función del archivo shttpd sub_417338 obtiene campos del front-end, los conecta a través de la función snprintf y los pasa a la función CsteSystem, lo que genera una vulnerabilidad de ejecución de comandos. • https://palm-jump-676.notion.site/CVE-2023-48800-ad96548d06c645738daf3ab77575fd74 https://www.notion.so/X6000R-sub_417338-ad96548d06c645738daf3ab77575fd74?pvs=4 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 1CVE-2023-43453
https://notcve.org/view.php?id=CVE-2023-43453
An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the IP parameter of the setDiagnosisCfg component. Un problema en TOTOLINK X6000R V9.4.0cu.652_B20230116 y V9.4.0cu.852_B20230719 permite a un atacante remoto ejecutar código arbitrario a través del parámetro IP del componente setDiagnosisCfg. • https://github.com/tharsis1024/vuln/blob/main/TOTOLINK/X6000R/2.md • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •