CVE-2023-4411

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 and classified as critical. This vulnerability affects the function setTracerouteCfg. The manipulation leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-237514 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
TOTOLINKEX1200LEN_V9.3.5u.6146_B20201023

References

Timeline

Published
Aug 18, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-441104.3Out-of-bounds access vulnerability in the audio module.Successful exploitation of this vulnerability may affect availability.CVE-2023-441117.5Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service coCVE-2023-441127.5Out-of-bounds access vulnerability in the device authentication module. Successful exploitation of this vulnerability may affect confidentiaCVE-2023-441137.5Vulnerability of missing permission verification for APIs in the Designed for Reliability (DFR) module. Successful exploitation of this vulnCVE-2023-441147.5Out-of-bounds array vulnerability in the dataipa module.Successful exploitation of this vulnerability may affect service confidentiality.CVE-2023-441157.5Vulnerability of improper permission control in the Booster module. Impact: Successful exploitation of this vulnerability may affect serviceCVE-2023-441169.8Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this vulnerability may caCVE-2023-441177.5Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect serCVE-2023-441189.1Vulnerability of undefined permissions in the MeeTime module.Successful exploitation of this vulnerability will affect availability and confCVE-2023-441197.5Vulnerability of mutual exclusion management in the kernel module.Successful exploitation of this vulnerability will affect availability.CVE-2023-44129.8A vulnerability was found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 and classified as critical. This issue affects the function setWanCfCVE-2023-441207.8A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q4). The affected product's sudo configuration permits the local