CVE-2023-52028 Command injection in n/a

Critical 9.8 Published 11 Jan 2024 Updated 20 Jun 2025

Attackers can execute arbitrary commands on TOTOlink A3700R routers via the setTracerouteCfg function, leading to remote code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-52028?

CVE-2023-52028 is a critical command injection vulnerability in n/a, published on 11 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the setTracerouteCfg function.

Weakness: CWE-78

Which versions are affected by CVE-2023-52028?

It affects 1 product.

Products include Totolink A3700r Firmware.

How do I fix CVE-2023-52028?

No fix has been published for CVE-2023-52028 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-52028 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-52028 exists.

Sources

Also known as GHSA-c2cx-q2qw-h3h8.