CRITICAL🇵🇱 Wersja polska

CVE-2023-52038

CVSS 9.8v3.1pub. 2024-01-24upd. 2025-05-30

An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415C80 function.

🤖 AI Analysis
How it works

The vulnerability lies in the sub_415C80 function of the TOTOLINK X6000R device firmware. An attacker can supply specially crafted input data that is not properly filtered or validated, leading to execution of embedded system commands. The attack can be performed remotely over the network without requiring any privileges or user interaction.

Impact

An attacker can gain full control of the device by executing arbitrary system commands, resulting in complete loss of confidentiality, integrity, and availability of the device.

Mitigation & patch

Security patches available from the manufacturer should be applied in accordance with the references. As a temporary measure, it is recommended to restrict access to the device's administrative panel only from trusted networks and to disable remote management through the WAN interface.

Who is affected

TOTOLINK X6000R firmware version v9.4.0cu.852_B20230719

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Totolink X6000r

    HW
    Totolink
    wszystkie wersje

  • Totolink X6000r Firmware

    OS
    Totolink
    9.4.0cu.852_b20230719
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-11005CRITICAL9.3PL ✓ten sam produkt

OS Command Injection w TOTOLINK X6000R — zdalne wykonanie poleceń

CVE-2025-52906CRITICAL9.3PL ✓ten sam produkt

OS Command Injection w firmware routera TOTOLINK X6000R

CVE-2025-52053CRITICAL9.8PL ✓ten sam produkt

Command injection w TOTOLINK X6000R – zdalne wykonanie kodu bez uwierzytelnienia

CVE-2024-52723CRITICAL9.8PL ✓ten sam produkt

Command injection w TOTOLINK X6000R — zdalne wykonanie poleceń bez uwierzytelnienia

CVE-2023-52039CRITICAL9.8PL ✓ten sam produkt

Command injection w TOTOLINK X6000R umożliwia zdalne wykonanie kodu