CVE-2023-37173
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
The TOTOLINK A3300R device in version V17.0.0cu.557_B20221024 was found to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function.
Risk Assessment
Exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the system, posing a serious security threat to the device and network.
Recommendation
It is recommended to update the device firmware to the latest version to mitigate this vulnerability and to monitor the system for unauthorized activities.
Other vulnerabilities in TOTOLINK A3300R
See all- CVE-2023-37172Critical
A command injection vulnerability was discovered in the TOTOLINK A3300R device version V17.0.0cu.557_B20221024 via the ip parameter in the setDiagnosisCfg function.
- CVE-2023-37171Critical
The TOTOLINK A3300R device version V17.0.0cu.557_B20221024 was found to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function.
- CVE-2023-37170Critical
The TOTOLINK A3300R device version V17.0.0cu.557_B20221024 has been found to contain an unauthenticated remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.
- CVE-2023-31729Critical
TOTOLINK A3300R router firmware v17.0.0cu.557 is vulnerable to Command Injection via the /cgi-bin/cstecgi.cgi CGI script. An attacker can remotely execute arbitrary system commands without authentication.
- CVE-2026-5679Medium
A vulnerability was detected in Totolink A3300R 17.0.0cu.557_B20221024 allowing OS command injection via the vsetTr069Cfg function in /cgi-bin/cstecgi.cgi. The attack can be launched remotely and the exploit is publicly available.
Original NVD description (English source)
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function.