Sign-up

ID

VAR-202312-0767


CVE

CVE-2023-51026


TITLE

TOTOLINK EX1800T setRebootScheCfg interface command execution vulnerability

Trust: 0.6

sources: CNVD: CNVD-2024-21658

DESCRIPTION

TOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘hour’ parameter of the setRebootScheCfg interface of the cstecgi .cgi. TOTOLINK EX1800T is a Wi-Fi range extender from China's TOTOLINK Electronics. The vulnerability is caused by the hour parameter of the setRebootScheCfg interface of cstecgi.cgi failing to properly filter special characters and commands in the constructed command. An attacker can exploit this vulnerability to execute arbitrary commands on the system

Trust: 1.44

sources: NVD: CVE-2023-51026 // CNVD: CNVD-2024-21658

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-21658

AFFECTED PRODUCTS

vendor:totolinkmodel:ex1800tscope:eqversion:9.1.0cu.2112_b20220316

Trust: 1.0

vendor:totolinkmodel:ex1800t v9.1.0cu.2112 b20220316scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2024-21658 // NVD: CVE-2023-51026

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-51026
value: CRITICAL

Trust: 1.0

CNVD: CNVD-2024-21658
value: HIGH

Trust: 0.6

CNVD: CNVD-2024-21658
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2023-51026
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2024-21658 // NVD: CVE-2023-51026

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-94

Trust: 1.0

sources: NVD: CVE-2023-51026

EXTERNAL IDS

db:NVDid:CVE-2023-51026

Trust: 1.6

db:CNVDid:CNVD-2024-21658

Trust: 0.6

sources: CNVD: CNVD-2024-21658 // NVD: CVE-2023-51026

REFERENCES

url:https://815yang.github.io/2023/12/11/ex1800t/2/totolinkex1800t_v9.1.0cu.2112_b2022031setrebootschecfg-hour/

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2023-51026

Trust: 0.6

sources: CNVD: CNVD-2024-21658 // NVD: CVE-2023-51026

SOURCES

db:CNVDid:CNVD-2024-21658
db:NVDid:CVE-2023-51026

LAST UPDATE DATE

2024-08-28T23:07:02.717000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2024-21658date:2024-05-08T00:00:00
db:NVDid:CVE-2023-51026date:2024-08-27T21:35:04.070

SOURCES RELEASE DATE

db:CNVDid:CNVD-2024-21658date:2024-05-10T00:00:00
db:NVDid:CVE-2023-51026date:2023-12-22T18:15:07.907