CVE-2023-46685

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A hard-coded password vulnerability exists in the telnetd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A set of specially crafted network packets can lead to arbitrary command execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-259 CWE-798

Affected software

Vendor	Product	Versions
LevelOne	WBR-6013	RER4_A_v3411b_2T2R_LEV_09_170623
realtek	rtl819x_software_development_kit	3.4.11
level_one	wbr6013	rer4_a_v3411b_2t2r_lev_09_170623

References

https://talosintelligence.com/vulnerability_reports/TALOS-2023-1871Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1871Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1871

Timeline

Published: Jul 8, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-466867.1A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallagher Command Centre Diag CVE-2023-466879.8In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could execute arbitrary commands i CVE-2023-466886.1Open redirect vulnerability in Pleasanter 1.3.47.0 and earlier allows a remote unauthenticated attacker to redirect users to arbitrary web s CVE-2023-466897.8Improper neutralization in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable escal CVE-2023-46699.8Authentication Bypass by Assumed-Immutable Data vulnerability in Exagate SYSGuard 3001 allows Authentication Bypass. This issue affects SYS CVE-2023-466908.8In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an attacker to write to any file to any location o CVE-2023-466917.8Use after free in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation o CVE-2023-466936.1Cross Site Scripting (XSS) vulnerability in FormaLMS before 4.0.5 allows attackers to run arbitrary code via title parameters.CVE-2023-466948.1Vtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote commands. This flaw ex CVE-2023-466957.5An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As CVE-2023-466994.3Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0. If a user views a CVE-2023-46709.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Innosa Probbys allows SQL Injection.