CVE Feed

    Dashboard / CVE / CVE-2023-48800

    CVE-2023-48800

    In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_417338 function obtains fields from the front-end, connects them through the snprintf function, and passes them to the CsteSystem function, resulting in a command execution vulnerability.

    Published:Dec 4, 2023
    Last Modified:Nov 21, 2024
    EPS:Dec 4, 2023
    EPSS Score:0.00711
    CVSS Score:9.8

    Affected Products

    Vendor
    Totolink
    Product
    X6000r
    Vendor
    Totolink
    Product
    X6000r Firmware

    Exploits

    https://palm-jump-676.notion.site/CVE-2023-48800-ad96548d06c645738daf3ab77575fd74https://www.notion.so/X6000R-sub_417338-ad96548d06c645738daf3ab77575fd74?pvs=4https://palm-jump-676.notion.site/CVE-2023-48800-ad96548d06c645738daf3ab77575fd74https://www.notion.so/X6000R-sub_417338-ad96548d06c645738daf3ab77575fd74?pvs=4

    Related CVEs

    CVE-2026-4611 (CVSS 8.6) — A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Affected by this issue…
    CVE-2025-70328 (CVSS 8.8) — TOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in the NTPSyncWithHost …
    CVE-2026-1723 (CVSS 9.2) — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TO…
    CVE-2025-11005 (CVSS 9.3) — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TO…
    CVE-2025-52907 (CVSS 7.3) — Improper Input Validation vulnerability in TOTOLINK X6000R allows Command Injection, File Manipulation.This is…
    CVE-2025-52906 (CVSS 9.3) — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TO…
    CVE-2025-52905 (CVSS 7) — Improper Input Validation vulnerability in TOTOLINK X6000R allows Flooding.This issue affects X6000R: through …
    CVE-2025-52053 (CVSS 9.8) — TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_417D…
    CVE-2025-52284 (CVSS 6.5) — Totolink X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_4184…
    CVE-2025-25524 (CVSS 5.1) — Buffer overflow vulnerability in TOTOLink X6000R routers V9.4.0cu.652_B20230116 due to the lack of length veri…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High