Lucene search
HistoryNov 30, 2023 - 6:15 p.m.
CVE-2023-48802
totolink x6000r
v9.4.0cu.852_b20230719
shttpd file
command execution vulnerability
uci set the str function
cstesystem function
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.004
Percentile
75.3%
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
Affected configurations
Node
totolinkx6000rMatch-
totolinkx6000r_firmwareMatch9.4.0cu.852_b20230719
| Vendor | Product | Version | CPE |
|---|---|---|---|
| totolink | x6000r | - | cpe:2.3:h:totolink:x6000r:-:*:*:*:*:*:*:* |
| totolink | x6000r_firmware | 9.4.0cu.852_b20230719 | cpe:2.3:o:totolink:x6000r_firmware:9.4.0cu.852_b20230719:*:*:*:*:*:*:* |
Related
cvelist
cvelist
CVE-2023-48802
2023-11-30 00:00:00
prion
prion
Command injection
2023-11-30 18:15:00
cve
cve
CVE-2023-48802
2023-11-30 18:15:07
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.004
Percentile
75.3%
Related for NVD:CVE-2023-48802