AI Score
Confidence
Low
EPSS
Percentile
48.7%
SSVC
Exploitation
poc
Automatable
no
Technical Impact
total
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setL2tpServerCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
[
{
"cpes": [
"cpe:2.3:o:totolink:x5000r_firmware:9.1.0cu.2350_b20230313:*:*:*:*:*:*:*"
],
"vendor": "totolink",
"product": "x5000r_firmware",
"versions": [
{
"status": "affected",
"version": "9.1.0cu.2350_b20230313"
}
],
"defaultStatus": "unknown"
}
]