CVE-2023-52039

An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415AA4 function

Critical · published January 24, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
55.1
In the wild
Unconfirmed
What it is

🔥 A single function flaw in TOTOLINK X6000R is like leaving the front door wide open for attackers — they can run ANY command they choose! ⚡ Think of it as a restaurant where the chef can accept orders without anyone checking the ticket. If a rogue customer walks in, they could cook whatever dish they fancy, leaving the restaurant in chaos! This vulnerability could lead to absolute mayhem, giving attackers the keys to your network. They could install malware, steal sensitive data, or even take control of your entire device — the consequences could be devastating!

Put simply

Think of it as a restaurant where the chef can accept orders without anyone checking the ticket. If a rogue customer walks in, they could cook whatever dish they fancy, leaving the restaurant in chaos! The issue in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to execute arbitrary commands through the sub_415AA4 function, bypassing standard security checks entirely.

What to do

This vulnerability could lead to absolute mayhem, giving attackers the keys to your network. They could install malware, steal sensitive data, or even take control of your entire device — the consequences could be devastating! Immediate action is crucial! Patch your device to the latest firmware version as soon as it’s available, and check your network settings and access controls to ensure no unauthorized users can take advantage of this vulnerability. You've got this! Stay proactive and secure your devices, and you'll be a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00770 · 55.1th percentile
Published
2024-01-24T00:00Z
EPSS history
Timeline
  • 24 JAN 00:00Z
    An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415AA4 function
    cvelistv5