CVE-2023-4412
MediumCVSS 6.3Exploitation Probability (EPSS)
High risk87th percentile - higher than 87% of all known CVEs
Summary
A critical vulnerability was found in the TOTOLINK EX1200L device in version EN_V9.3.5u.6146_B20201023, affecting the setWanCfg function. Manipulation of this function leads to OS command injection.
Risk Assessment
An attacker can remotely exploit this vulnerability, posing a serious threat to the security of the system and the organization's data.
Recommendation
It is recommended to immediately update the device to the latest firmware version to mitigate this vulnerability.
Original NVD description (English source)
A vulnerability was found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 and classified as critical. This issue affects the function setWanCfg. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-237515. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.