CVE-2023-37148
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
The TOTOLINK LR350 version V9.3.5u.6369_B20220309 was found to contain a command injection vulnerability via the ussd parameter in the setUssd function.
Risk Assessment
Exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the system, posing a serious security risk to the device and network.
Recommendation
It is recommended to update the device firmware to the latest version to mitigate this vulnerability.
Other vulnerabilities in TOTOLINK LR350
See all- CVE-2026-1158High
A buffer overflow vulnerability has been discovered in the Totolink LR350 9.3.5u.6369_B20220309 in the setWizardCfg function of /cgi-bin/cstecgi.cgi. The attack involves manipulating the ssid argument in a POST request and can be performed remotely. The exploit has been publicly released, increasing the risk of exploitation.
- CVE-2026-1157High
Vulnerability in Totolink LR350 router in the setWiFiEasyCfg function of /cgi-bin/cstecgi.cgi. Manipulation of the ssid argument causes a buffer overflow. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-1156High
Vulnerability in Totolink LR350 router in the setWiFiBasicCfg function of /cgi-bin/cstecgi.cgi. Manipulation of the ssid argument causes a buffer overflow. The attack can be performed remotely, and the exploit is publicly disclosed.
- CVE-2026-1155High
Vulnerability in Totolink LR350 router in the setWiFiEasyGuestCfg function of /cgi-bin/cstecgi.cgi. Manipulation of the ssid argument causes a buffer overflow. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2023-37149Critical
The TOTOLINK LR350 device version V9.3.5u.6369_B20220309 was found to contain a command injection vulnerability via the FileName parameter in the setUploadSetting function.
- CVE-2023-37146Critical
The TOTOLINK LR350 version V9.3.5u.6369_B20220309 was found to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.
Original NVD description (English source)
TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the ussd parameter in the setUssd function.