CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-6612 – Totolink X5000R cstecgi.cgi setWizardCfg os command injection
https://notcve.org/view.php?id=CVE-2023-6612
08 Dec 2023 — A vulnerability was found in Totolink X5000R 9.1.0cu.2300_B20230112. It has been rated as critical. This issue affects the function setDdnsCfg/setDynamicRoute/setFirewallType/setIPSecCfg/setIpPortFilterRules/setLancfg/setLoginPasswordCfg/setMacFilterRules/setMtknatCfg/setNetworkConfig/setPortForwardRules/setRemoteCfg/setSSServer/setScheduleCfg/setSmartQosCfg/setStaticDhcpRules/setStaticRoute/setVpnAccountCfg/setVpnPassCfg/setVpnUser/setWiFiAclAddConfig/setWiFiEasyGuestCfg/setWiFiGuestCfg/setWiFiRepeaterConf... • https://github.com/OraclePi/repo/tree/main/totolink%20X5000R • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 1CVE-2023-48860
https://notcve.org/view.php?id=CVE-2023-48860
07 Dec 2023 — TOTOLINK N300RT version 3.2.4-B20180730.0906 has a post-authentication RCE due to incorrect access control, allows attackers can bypass front-end security restrictions and execute arbitrary code. TOTOLINK N300RT versión 3.2.4-B20180730.0906 tiene un RCE de autenticación posterior debido a un control de acceso incorrecto, lo que permite a los atacantes eludir las restricciones de seguridad del front-end y ejecutar código arbitrario. • https://github.com/xieqiang11/security_research/blob/main/TOTOLINK-N300RT-RCE.md •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2023-48859
https://notcve.org/view.php?id=CVE-2023-48859
06 Dec 2023 — TOTOLINK A3002RU version 2.0.0-B20190902.1958 has a post-authentication RCE due to incorrect access control, allows attackers to bypass front-end security restrictions and execute arbitrary code. TOTOLINK A3002RU versión 2.0.0-B20190902.1958 tiene un RCE de autenticación posterior debido a un control de acceso incorrecto, permite a los atacantes eludir las restricciones de seguridad del front-end y ejecutar código arbitrario. • https://github.com/xieqiang11/security_research/blob/main/TOTOLINK-A3002RU-RCE.md • CWE-863: Incorrect Authorization •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 2CVE-2023-48799
https://notcve.org/view.php?id=CVE-2023-48799
04 Dec 2023 — TOTOLINK-X6000R Firmware-V9.4.0cu.852_B20230719 is vulnerable to Command Execution. TOTOLINK-X6000R Firmware-V9.4.0cu.852_B20230719 es vulnerable a la ejecución de comandos. • https://palm-jump-676.notion.site/CVE-2023-48799-632dd667b4574a2c84b04035d04afb5c •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 2CVE-2023-48800
https://notcve.org/view.php?id=CVE-2023-48800
04 Dec 2023 — In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_417338 function obtains fields from the front-end, connects them through the snprintf function, and passes them to the CsteSystem function, resulting in a command execution vulnerability. En TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, la función del archivo shttpd sub_417338 obtiene campos del front-end, los conecta a través de la función snprintf y los pasa a la función CsteSystem, lo que genera una vulnerabilidad de ejecución de ... • https://palm-jump-676.notion.site/CVE-2023-48800-ad96548d06c645738daf3ab77575fd74 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 2CVE-2023-48801
https://notcve.org/view.php?id=CVE-2023-48801
01 Dec 2023 — In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_415534 function obtains fields from the front-end, connects them through the snprintf function, and passes them to the CsteSystem function, resulting in a command execution vulnerability. En TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, la función del archivo shttpd sub_415534 obtiene campos del front-end, los conecta a través de la función snprintf y los pasa a la función CsteSystem, lo que genera una vulnerabilidad de ejecución de ... • https://palm-jump-676.notion.site/CVE-2023-48801-40d4553fc7a649fe833201fcecf76f2b • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 1CVE-2023-43453
https://notcve.org/view.php?id=CVE-2023-43453
01 Dec 2023 — An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the IP parameter of the setDiagnosisCfg component. Un problema en TOTOLINK X6000R V9.4.0cu.652_B20230116 y V9.4.0cu.852_B20230719 permite a un atacante remoto ejecutar código arbitrario a través del parámetro IP del componente setDiagnosisCfg. • https://github.com/tharsis1024/vuln/blob/main/TOTOLINK/X6000R/2.md • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 1CVE-2023-43454
https://notcve.org/view.php?id=CVE-2023-43454
01 Dec 2023 — An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the hostName parameter of the switchOpMode component. Un problema en TOTOLINK X6000R V9.4.0cu.652_B20230116 y V9.4.0cu.852_B20230719 permite a un atacante remoto ejecutar código arbitrario a través del parámetro hostName del componente switchOpMode. • https://github.com/tharsis1024/vuln/blob/main/TOTOLINK/X6000R/1.md • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 1CVE-2023-43455
https://notcve.org/view.php?id=CVE-2023-43455
01 Dec 2023 — An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the command parameter of the setting/setTracerouteCfg component. Un problema en TOTOLINK X6000R V9.4.0cu.652_B20230116 y V9.4.0cu.852_B20230719 permite a un atacante remoto ejecutar código arbitrario a través del parámetro de comando del componente setTracerouteCfg. • https://github.com/tharsis1024/vuln/blob/main/TOTOLINK/X6000R/3.md • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 1CVE-2023-48802
https://notcve.org/view.php?id=CVE-2023-48802
30 Nov 2023 — In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability. En TOTOLINK X6000R V9.4.0cu.852_B20230719, el archivo shttpd, la función sub_4119A0 obtiene campos del front-end a través de Uci_ Set_. La función Str cuando se pasa a la función CsteSystem crea una vulnerabilidad de ejecución de comandos. • https://www.notion.so/X6000R-sub_4119A0-6-9541a9b3387a40de856a1cad692ba8d4?pvs=4 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •