Sign-up

ID

VAR-202312-2147


CVE

CVE-2023-51027


TITLE

TOTOLINK EX1800T setWiFiExtenderConfig interface command execution vulnerability

Trust: 0.6

sources: CNVD: CNVD-2024-21661

DESCRIPTION

TOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘apcliAuthMode’ parameter of the setWiFiExtenderConfig interface of the cstecgi .cgi. TOTOLINK EX1800T is a Wi-Fi range extender from China's TOTOLINK Electronics. The vulnerability is caused by the apcliAuthMode parameter of the setWiFiExtenderConfig interface of cstecgi.cgi failing to properly filter special characters and commands in constructed commands. An attacker can exploit this vulnerability to execute arbitrary commands on the system

Trust: 1.44

sources: NVD: CVE-2023-51027 // CNVD: CNVD-2024-21661

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-21661

AFFECTED PRODUCTS

vendor:totolinkmodel:ex1800tscope:eqversion:9.1.0cu.2112_b20220316

Trust: 1.0

vendor:totolinkmodel:ex1800t v9.1.0cu.2112 b20220316scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2024-21661 // NVD: CVE-2023-51027

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-51027
value: CRITICAL

Trust: 1.0

CNVD: CNVD-2024-21661
value: HIGH

Trust: 0.6

CNVD: CNVD-2024-21661
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2023-51027
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2024-21661 // NVD: CVE-2023-51027

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2023-51027

EXTERNAL IDS

db:NVDid:CVE-2023-51027

Trust: 1.6

db:CNVDid:CNVD-2024-21661

Trust: 0.6

sources: CNVD: CNVD-2024-21661 // NVD: CVE-2023-51027

REFERENCES

url:https://815yang.github.io/2023/12/11/ex1800t/2/3/totolinkex1800t_v9.1.0cu.2112_b20220316setwifiextenderconfig-apcliauthmode/

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2023-51027

Trust: 0.6

sources: CNVD: CNVD-2024-21661 // NVD: CVE-2023-51027

SOURCES

db:CNVDid:CNVD-2024-21661
db:NVDid:CVE-2023-51027

LAST UPDATE DATE

2024-08-14T15:10:23.988000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2024-21661date:2024-05-08T00:00:00
db:NVDid:CVE-2023-51027date:2023-12-27T21:10:41.763

SOURCES RELEASE DATE

db:CNVDid:CNVD-2024-21661date:2024-05-10T00:00:00
db:NVDid:CVE-2023-51027date:2023-12-22T18:15:07.953