CVE-2023-33486

EUVD-2023-37649
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setOpModeCfg. This vulnerability allows an attacker to execute arbitrary commands through the "hostName" parameter.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA-ADPADP
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 75%
Affected Products (NVD)
VendorProductVersion
totolinkx5000r_firmware
9.1.0u.6118_b20201102:u.6118_b20201102
totolinkx5000r_firmware
9.1.0u.6369_b20230113:u.6369_b20230113
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/Kazamayc/vuln/tree/main/TOTOLINK/X5000R/3
https://github.com/Kazamayc/vuln/tree/main/TOTOLINK/X5000R/3