CVE-2023-48808

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Nov 30, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-488109.8In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str CVE-2023-488119.8In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str CVE-2023-488129.8In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str fCVE-2023-488138.8Senayan Library Management Systems (Slims) 9 Bulian v9.6.1 is vulnerable to SQL Injection via admin/modules/reporting/customs/fines_report.pCVE-2023-488156.1kkFileView v4.3.0 is vulnerable to Incorrect Access Control.CVE-2023-48827.5DOS vulnerability that could allow an attacker to register a new VNF (Virtual Network Function) value. This action could trigger the args_asCVE-2023-488239.8A Blind SQL injection issue in ajax.php in GaatiTrack Courier Management System 1.0 allows an unauthenticated attacker to inject a payload vCVE-2023-488245.4BoidCMS 2.0.1 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the title, subtitle, footer, or keywords parameter in aCVE-2023-488255.4Availability Booking Calendar 5.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code.CVE-2023-488268.8Time Slots Booking Calendar 4.0 is vulnerable to CSV Injection via the unique ID field of the Reservations List.CVE-2023-488275.4Time Slots Booking Calendar 4.0 is vulnerable to Multiple HTML Injection issues via the name, plugin_sms_api_key, plugin_sms_country_code, cCVE-2023-488285.4Time Slots Booking Calendar 4.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_
CVE-2023-48808: Critical severity, CVSS 9.8 | Vulnix