Lucene search
HistoryMay 16, 2023 - 3:15 p.m.
CVE-2023-31856
command injection
hosttime parameter
ntpsyncwithhost
totolink cp300+
arbitrary commands
crafted http packet
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.05 Low
EPSS
Percentile
92.9%
A command injection vulnerability in the hostTime parameter in the function NTPSyncWithHostof TOTOLINK CP300+ V5.2cu.7594_B20200910 allows attackers to execute arbitrary commands via a crafted http packet.
Affected configurations
Node
totolinkcp300\+_firmwareMatch5.2cu.7594_b20200910
totolinkcp300\+Match-
Related
prion
prion
Command injection
2023-05-16 15:15:00
cve
cve
CVE-2023-31856
2023-05-16 15:15:09
cvelist
cvelist
CVE-2023-31856
2023-05-16 00:00:00
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.05 Low
EPSS
Percentile
92.9%
Related for NVD:CVE-2023-31856