CVE-2023-37149

CriticalCVSS 9.8

Published: 07/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.67%

74th percentile - higher than 74% of all known CVEs

Summary

The TOTOLINK LR350 device version V9.3.5u.6369_B20220309 was found to contain a command injection vulnerability via the FileName parameter in the setUploadSetting function.

Risk Assessment

Exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the system, posing a serious threat to the security of the device and the network.

Recommendation

It is recommended to update the device firmware to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.

Original NVD description (English source)

TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadSetting function.