cbcvebase.
CVE-2023-46574
published 2023-10-25

CVE-2023-46574: An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile…

PriorityP186critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
65.41%
99.2th percentile
An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile function.

Affected

1 ranges
VendorProductVersion rangeFixed in
totolinka3700r_firmware——

Detection & IOCsextracted from sources · hover to see the quote

url/cgi-bin/cstecgi.cgi↗
command{"topicurl":"UploadFirmwareFile","FileName":";id"}↗
yara↗
regex: uid=([0-9(a-z)]+) gid=([0-9(a-z)]+) groups=([0-9(a-z)]+)
  • →Exploit targets the UploadFirmwareFile function via the FileName parameter with command injection (e.g., ';id') sent as a JSON body to /cgi-bin/cstecgi.cgi using a GET request. ↗
  • →Successful exploitation returns command output in the HTTP response body matching the pattern: uid=... gid=... groups=... — monitor for this pattern in responses from /cgi-bin/cstecgi.cgi. ↗
  • →Shodan/FOFA exposure queries can identify internet-facing TOTOLINK devices: search for title 'Totolink' or 'totolink'. ↗
  • →The vulnerability is unauthenticated (PR:N) and network-reachable (AV:N), meaning no credentials are required to exploit the UploadFirmwareFile endpoint. ↗
  • ·Affected version is specifically TOTOLINK A3700R firmware v.9.1.2u.6165_20211012 only; other firmware versions are not confirmed vulnerable. ↗
  • ·The exploit uses a GET request with a JSON body — some WAFs or detection tools may not inspect GET request bodies, reducing detection coverage. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.