Lucene search
HistoryOct 31, 2023 - 3:15 p.m.
CVE-2023-46993
cve-2023-46993
totolink
a3300r
v17.0.0cu.557_b20221024
command injection
security vulnerability
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.6 High
AI Score
Confidence
High
0.681 Medium
EPSS
Percentile
98.0%
In TOTOLINK A3300R V17.0.0cu.557_B20221024 when dealing with setLedCfg request, there is no verification for the enable parameter, which can lead to command injection.
Affected configurations
Node
totolinka3300r_firmwareMatch17.0.0cu.557_b20221024
totolinka3300rMatch-
| CPE | Name | Operator | Version |
|---|---|---|---|
| totolink:a3300r_firmware | totolink a3300r firmware | eq | 17.0.0cu.557_b20221024 |
Related
cvelist
cvelist
CVE-2023-46993
2023-10-31 00:00:00
prion
prion
Command injection
2023-10-31 15:15:00
nvd
nvd
CVE-2023-46993
2023-10-31 15:15:09
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.6 High
AI Score
Confidence
High
0.681 Medium
EPSS
Percentile
98.0%
Related for CVE-2023-46993