Details of VAR-202312-1976

ID

VAR-202312-1976

CVE

CVE-2023-51019

TITLE

TOTOLINK of ex1800t Firmware vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2023-023771

DESCRIPTION

TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘key5g’ parameter of the setWiFiExtenderConfig interface of the cstecgi .cgi. TOTOLINK of ex1800t There are unspecified vulnerabilities in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK EX1800T is a Wi-Fi range extender from China's TOTOLINK Electronics. The vulnerability is caused by the key5g parameter of the setWiFiExtenderConfig interface of cstecgi.cgi failing to properly filter special characters and commands in the constructed command. An attacker can exploit this vulnerability to execute arbitrary commands on the system

Trust: 2.16

sources: NVD: CVE-2023-51019 // JVNDB: JVNDB-2023-023771 // CNVD: CNVD-2024-21662

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2024-21662

AFFECTED PRODUCTS

vendor:	totolink	model:	ex1800t	scope:	eq	version:	9.1.0cu.2112_b20220316	Trust: 1.0
vendor:	totolink	model:	ex1800t	scope:	eq	version:	-	Trust: 0.8
vendor:	totolink	model:	ex1800t	scope:	-	version:	-	Trust: 0.8
vendor:	totolink	model:	ex1800t	scope:	eq	version:	ex1800t firmware 9.1.0cu.2112 b20220316	Trust: 0.8
vendor:	totolink	model:	ex1800t v9.1.0cu.2112 b20220316	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2024-21662 // JVNDB: JVNDB-2023-023771 // NVD: CVE-2023-51019

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2023-51019
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2023-51019
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2024-21662
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2024-21662
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2023-51019
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2023-51019
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2024-21662 // JVNDB: JVNDB-2023-023771 // NVD: CVE-2023-51019

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	Lack of information (CWE-noinfo) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2023-023771 // NVD: CVE-2023-51019

EXTERNAL IDS

db:	NVD	id:	CVE-2023-51019	Trust: 3.2
db:	JVNDB	id:	JVNDB-2023-023771	Trust: 0.8
db:	CNVD	id:	CNVD-2024-21662	Trust: 0.6

sources: CNVD: CNVD-2024-21662 // JVNDB: JVNDB-2023-023771 // NVD: CVE-2023-51019

REFERENCES

url:	https://815yang.github.io/2023/12/11/ex1800t/2/totolinkex1800t_v9.1.0cu.2112_b20220316setwifiextenderconfig-key5g/	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2023-51019	Trust: 1.4

sources: CNVD: CNVD-2024-21662 // JVNDB: JVNDB-2023-023771 // NVD: CVE-2023-51019

SOURCES

db:	CNVD	id:	CNVD-2024-21662
db:	JVNDB	id:	JVNDB-2023-023771
db:	NVD	id:	CVE-2023-51019

LAST UPDATE DATE

2024-08-14T14:42:50.638000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2024-21662	date:	2024-05-08T00:00:00
db:	JVNDB	id:	JVNDB-2023-023771	date:	2024-01-29T07:35:00
db:	NVD	id:	CVE-2023-51019	date:	2023-12-27T21:09:43.747

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2024-21662	date:	2024-05-10T00:00:00
db:	JVNDB	id:	JVNDB-2023-023771	date:	2024-01-29T00:00:00
db:	NVD	id:	CVE-2023-51019	date:	2023-12-22T19:15:09.630