CVE-2023-39617

CriticalCVSS 9.8

Published: 21/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.39%

69th percentile - higher than 69% of all known CVEs

Summary

TOTOLINK X5000R_V9.1.0cu.2089_B20211224 and X5000R_V9.1.0cu.2350_B20230313 were found to contain a remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.

Risk Assessment

This vulnerability could allow attackers to remotely execute arbitrary code on the device, posing a significant security risk to the network.

Recommendation

It is recommended to update the device firmware to the latest version to mitigate this vulnerability.

Original NVD description (English source)

TOTOLINK X5000R_V9.1.0cu.2089_B20211224 and X5000R_V9.1.0cu.2350_B20230313 were discovered to contain a remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.