CVE-2023-4411: medium-severity vulnerability in TOTOLINK EX1200L
TOTOLINK EX1200L setTracerouteCfg os command injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.3epss 5.2%
A vulnerability has been found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 and classified as critical. This vulnerability affects the function setTracerouteCfg. The manipulation leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-237514 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected products
TOTOLINK · EX1200LRelated CVEs — TOTOLINK EX1200L
In the same product, most dangerous first.
CVE-2023-4412MEDIUMTOTOLINK EX1200L setWanCfg os command injectionEPSS 3.7%CVE-2023-4410MEDIUMTOTOLINK EX1200L setDiagnosisCfg os command injectionEPSS 3.7%CVE-2024-7909HIGHTOTOLINK EX1200L cstecgi.cgi setLanguageCfg stack-based overflowEPSS 1.5%CVE-2024-7908HIGHTOTOLINK EX1200L cstecgi.cgi setDefResponse stack-based overflowEPSS 1.5%CVE-2024-7338HIGHTOTOLINK EX1200L cstecgi.cgi setParentalRules buffer overflowEPSS 1.2%CVE-2024-7337HIGHTOTOLINK EX1200L cstecgi.cgi loginauth buffer overflowEPSS 1.2%