CVE-2023-31856

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A command injection vulnerability in the hostTime parameter in the function NTPSyncWithHostof TOTOLINK CP300+ V5.2cu.7594_B20200910 allows attackers to execute arbitrary commands via a crafted http packet.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published: May 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-318579.8Sourcecodester Online Computer and Laptop Store 1.0 allows unrestricted file upload and can lead to remote code execution. The vulnerability CVE-2023-31869.8The Popup by Supsystic WordPress plugin before 1.10.19 has a prototype pollution vulnerability that could allow an attacker to inject arbitr CVE-2023-318605.4Wuzhi CMS v3.1.2 has a storage type XSS vulnerability in the backend of the Five Finger CMS b2b system.CVE-2023-318617.5ZLMediaKit 4.0 is vulnerable to Directory Traversal.CVE-2023-318625.4jizhicms v2.4.6 is vulnerable to Cross Site Scripting (XSS). The content of the article published in the front end is only filtered in the f CVE-2023-318677.2Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection.CVE-2023-318685.4Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). Some parts of the Web application are dynamically built using user CVE-2023-31875.4A vulnerability, which was classified as critical, has been found in PHPGurukul Teachers Record Management System 1.0. Affected by this issu CVE-2023-318717.8OpenText Documentum Content Server before 23.2 has a flaw that allows for privilege escalation from a non-privileged Documentum user to root CVE-2023-318737.8Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require('child_process').CVE-2023-318748.8Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_process').CVE-2023-31886.5Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0.