CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 1CVE-2023-43453
https://notcve.org/view.php?id=CVE-2023-43453
01 Dec 2023 — An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the IP parameter of the setDiagnosisCfg component. Un problema en TOTOLINK X6000R V9.4.0cu.652_B20230116 y V9.4.0cu.852_B20230719 permite a un atacante remoto ejecutar código arbitrario a través del parámetro IP del componente setDiagnosisCfg. • https://github.com/tharsis1024/vuln/blob/main/TOTOLINK/X6000R/2.md • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 1CVE-2023-43454
https://notcve.org/view.php?id=CVE-2023-43454
01 Dec 2023 — An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the hostName parameter of the switchOpMode component. Un problema en TOTOLINK X6000R V9.4.0cu.652_B20230116 y V9.4.0cu.852_B20230719 permite a un atacante remoto ejecutar código arbitrario a través del parámetro hostName del componente switchOpMode. • https://github.com/tharsis1024/vuln/blob/main/TOTOLINK/X6000R/1.md • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 1CVE-2023-43455
https://notcve.org/view.php?id=CVE-2023-43455
01 Dec 2023 — An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the command parameter of the setting/setTracerouteCfg component. Un problema en TOTOLINK X6000R V9.4.0cu.652_B20230116 y V9.4.0cu.852_B20230719 permite a un atacante remoto ejecutar código arbitrario a través del parámetro de comando del componente setTracerouteCfg. • https://github.com/tharsis1024/vuln/blob/main/TOTOLINK/X6000R/3.md • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 1CVE-2023-48802
https://notcve.org/view.php?id=CVE-2023-48802
30 Nov 2023 — In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability. En TOTOLINK X6000R V9.4.0cu.852_B20230719, el archivo shttpd, la función sub_4119A0 obtiene campos del front-end a través de Uci_ Set_. La función Str cuando se pasa a la función CsteSystem crea una vulnerabilidad de ejecución de comandos. • https://www.notion.so/X6000R-sub_4119A0-6-9541a9b3387a40de856a1cad692ba8d4?pvs=4 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 1CVE-2023-48803
https://notcve.org/view.php?id=CVE-2023-48803
30 Nov 2023 — In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability. En TOTOLINK X6000R V9.4.0cu.852_B20230719, el archivo shttpd, la función sub_4119A0 obtiene campos del front-end a través de Uci_ Set_. La función Str cuando se pasa a la función CsteSystem crea una vulnerabilidad de ejecución de comandos. • https://www.notion.so/X6000R-sub_4119A0-4-aead0a851416422ea2e282409eec3351?pvs=4 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 1CVE-2023-48804
https://notcve.org/view.php?id=CVE-2023-48804
30 Nov 2023 — In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability. En TOTOLINK X6000R V9.4.0cu.852_B20230719, el archivo shttpd, la función sub_4119A0 obtiene campos del front-end a través de Uci_ Set_. La función Str cuando se pasa a la función CsteSystem crea una vulnerabilidad de ejecución de comandos. • https://www.notion.so/X6000R-sub_4119A0-1-e9697e90e8b04e05a6d10c9fb7288750?pvs=4 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 1CVE-2023-48805
https://notcve.org/view.php?id=CVE-2023-48805
30 Nov 2023 — In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability. En TOTOLINK X6000R V9.4.0cu.852_B20230719, el archivo shttpd, la función sub_4119A0 obtiene campos del front-end a través de Uci_ Set_. La función Str cuando se pasa a la función CsteSystem crea una vulnerabilidad de ejecución de comandos. • https://www.notion.so/X6000R-sub_4119A0-2-6a912e23617244409ae8c5837d4288b4?pvs=4 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 1CVE-2023-48806
https://notcve.org/view.php?id=CVE-2023-48806
30 Nov 2023 — In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability. En TOTOLINK X6000R V9.4.0cu.852_B20230719, el archivo shttpd, la función sub_4119A0 obtiene campos del front-end a través de Uci_ Set_. La función Str cuando se pasa a la función CsteSystem crea una vulnerabilidad de ejecución de comandos. • https://www.notion.so/X6000R-sub_4119A0-5-92b3d1e22e764ae7a18cdf0d8ac24e4f?pvs=4 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 1CVE-2023-48807
https://notcve.org/view.php?id=CVE-2023-48807
30 Nov 2023 — In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability. En TOTOLINK X6000R V9.4.0cu.852_B20230719, el archivo shttpd, la función sub_4119A0 obtiene campos del front-end a través de Uci_ Set_. La función Str cuando se pasa a la función CsteSystem crea una vulnerabilidad de ejecución de comandos. • https://www.notion.so/X6000R-sub_4119A0-3-1e21686eebf94cee8a7819d1d7aa29b9?pvs=4 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 1CVE-2023-48808
https://notcve.org/view.php?id=CVE-2023-48808
30 Nov 2023 — In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability. En TOTOLINK X6000R V9.4.0cu.852_B20230719, el archivo shttpd, la función sub_4119A0 obtiene campos del front-end a través de Uci_ Set_. La función Str cuando se pasa a la función CsteSystem crea una vulnerabilidad de ejecución de comandos. • https://www.notion.so/X6000R-sub_4119A0-9-075ccc78275a4381a65e114eb1fddd6e?pvs=4 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •