CVE-2023-46993: Command Injection

Published Oct 31, 2023

Updated

In TOTOLINK A3300R V17.0.0cu.557B20221024 when dealing with setLedCfg request, there is no verification for the enable parameter, which can lead to command injection.

Affected Software

2 affected components

All of the following

TOTOLINK A3300R firmware=17.0.0cu.557_b20221024

TOTOLINK A3300R

Event History

Oct 31, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2023-46993.

What is the title of the vulnerability?

The title of the vulnerability is 'In TOTOLINK A3300R V17.0.0cu.557_B20221024 when dealing with setLedCfg request there is no verification for the enable parameter, which can lead to command injection.'

What is the severity of CVE-2023-46993?

The severity of CVE-2023-46993 is critical with a severity value of 9.8.

How does CVE-2023-46993 impact TOTOLINK A3300R V17.0.0cu.557_B20221024?

CVE-2023-46993 allows command injection in TOTOLINK A3300R V17.0.0cu.557_B20221024 due to a lack of verification for the enable parameter in the setLedCfg request.

Is TOTOLINK A3300R V17.0.0cu.557_B20221024 vulnerable to CVE-2023-46993?

TOTOLINK A3300R V17.0.0cu.557_B20221024 is vulnerable to CVE-2023-46993.

How can the vulnerability be fixed in TOTOLINK A3300R V17.0.0cu.557_B20221024?

Please refer to the provided reference link for instructions on fixing the vulnerability.

What is the Common Weakness Enumeration (CWE) ID for CVE-2023-46993?

The Common Weakness Enumeration (CWE) ID for CVE-2023-46993 is CWE-77.