CVE-2023-31569
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk86th percentile - higher than 86% of all known CVEs
Summary
A command injection vulnerability was discovered in the TOTOLINK X5000R router firmware version V9.1.0cu.2350_B20230313 within the setWanCfg function. An attacker can remotely execute arbitrary system commands without authentication.
Risk Assessment
The risk involves potential full device takeover by an unauthenticated attacker, leading to network compromise, data theft, or the router being used as part of a botnet.
Recommendation
Immediately update the TOTOLINK X5000R firmware to the latest available version that patches this vulnerability. If no update is available, restrict management interface access to trusted networks only.
Original NVD description (English source)
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection via the setWanCfg function.