CVE-2023-37172

CriticalCVSS 9.8

Published: 07/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.67%

74th percentile - higher than 74% of all known CVEs

Summary

A command injection vulnerability was discovered in the TOTOLINK A3300R device version V17.0.0cu.557_B20221024 via the ip parameter in the setDiagnosisCfg function.

Risk Assessment

Exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the system, posing a serious security threat to the device and network.

Recommendation

It is recommended to update the device firmware to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.

Original NVD description (English source)

TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function.