Lucene search

[email protected]NVD:CVE-2023-37149

HistoryJul 07, 2023 - 2:15 p.m.

CVE-2023-37149

2023-07-0714:15:09

CWE-77

[email protected]

web.nvd.nist.gov

totolink lr350

v9.3.5u.6369_b20220309

command injection

filename parameter

setuploadsetting function

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.556

Percentile

97.7%

JSON

TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadSetting function.

Affected configurations

Nvd

Node

totolinklr350_firmwareMatch9.3.5u.6369_b20220309

AND

totolinklr350Match-

VendorProductVersionCPE
totolinklr350_firmware9.3.5u.6369_b20220309cpe:2.3:o:totolink:lr350_firmware:9.3.5u.6369_b20220309:*:*:*:*:*:*:*
totolinklr350-cpe:2.3:h:totolink:lr350:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
totolink	lr350_firmware	9.3.5u.6369_b20220309	cpe:2.3:o:totolink:lr350_firmware:9.3.5u.6369_b20220309:::::::*
totolink	lr350	-	cpe:2.3:h:totolink:lr350:-:::::::*

References

github.com/DaDong-G/Vulnerability_info/blob/main/TOTOLINK/lr350/4/README.md

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.556

Percentile

97.7%

JSON

Related for NVD:CVE-2023-37149

prion1 cve1 cvelist1