TOTOLINK Wireless Routers Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/stopwatch' class MetasploitModule 'TOTOLINK Wireless Routers unauthenticated remote command execution vulnerability.', 'Description' = %q Multiple TOTOLINK...

TOTOLINK Wireless Routers Remote Command Execution Exploit

Multiple TOTOLINK network products contain a command injection vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the command parameter. After exploitation, an attacker will have full access with the same user privileges under...

CVE-2023-30013

creationtimestamp| type| source ---|---|--- 2023-05-05 18:25:18+00:00| seen| https://t.me/cibsecurity/63377 2023-09-21 09:45:44+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/totolinkunauthrcecve202330013.rb 2023-10-11 03:26:05+00:00|...

CVE-2023-30013

The connected sources confirm a command-injection vulnerability in TOTOLINK X5000R firmware versions 9.1.0u.6118_B20201102 and 9.1.0u.6369_B20230113, specifically in the setting/setTracerouteCfg endpoint, allowing unauthenticated remote execution of arbitrary OS commands via the command parameter...