CVE-2023-37170

CriticalCVSS 9.8

Published: 07/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.40%

69th percentile - higher than 69% of all known CVEs

Summary

The TOTOLINK A3300R device version V17.0.0cu.557_B20221024 has been found to contain an unauthenticated remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.

Risk Assessment

This vulnerability could allow attackers to remotely execute arbitrary code on the device, posing a significant security threat to the network.

Recommendation

It is recommended to update the device to the latest firmware version to mitigate this vulnerability and implement additional security measures.

Original NVD description (English source)

TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.