CVE-2023-48799 Command injection in n/a

Critical 9.8 Published 4 Dec 2023 Updated 2 Aug 2024

Attackers can execute arbitrary commands on TOTOLINK X6000R routers, potentially compromising the device.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-48799?

CVE-2023-48799 is a critical command injection vulnerability in Totolink X6000r Firmware, published on 4 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

TOTOLINK-X6000R Firmware-V9.4.0cu.852_B20230719 is vulnerable to Command Execution.

Which versions are affected by CVE-2023-48799?

It affects 1 product.

Products include Totolink X6000r Firmware.

How do I fix CVE-2023-48799?

No fix has been published for CVE-2023-48799 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-48799 being exploited?

There is no known exploitation of CVE-2023-48799 in the wild and no public exploit code.

All Totolink X6000r Firmware vulnerabilities

Sources

Also known as GHSA-f4hf-g9qr-gg3p.