CVE-2023-4410
MediumCVSS 6.3Exploitation Probability (EPSS)
High risk87th percentile - higher than 87% of all known CVEs
Summary
A critical vulnerability was found in the TOTOLINK EX1200L device version EN_V9.3.5u.6146_B20201023, affecting the setDiagnosisCfg function. Manipulation of this function leads to remote command injection.
Risk Assessment
The vulnerability allows for remote exploitation, potentially leading to serious security breaches within the organization. The public disclosure of the exploit increases the risk of this vulnerability being exploited.
Recommendation
It is recommended to immediately update the device to the latest firmware version to mitigate this vulnerability. Additionally, monitor systems for unauthorized activities.
Original NVD description (English source)
A vulnerability, which was classified as critical, was found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023. This affects the function setDiagnosisCfg. The manipulation leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-237513 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.