CVE-2023-50147
CRITICALCVSS 9.8/10EPSS 1.18%
Last modified
CVE-2023-50147 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. There is an arbitrary command execution vulnerability in the setDiagnosisCfg function of the cstecgi .cgi of the TOTOlink A3700R router device in its firmware version V9.1.2u.5822_B20200513.. EPSS estimates a 1.18% chance of exploitation in the next 30 days.
Description
There is an arbitrary command execution vulnerability in the setDiagnosisCfg function of the cstecgi .cgi of the TOTOlink A3700R router device in its firmware version V9.1.2u.5822_B20200513.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Totolink | A3700r Firmware | 9.1.2u.5822_b20200513 |
References
- https://815yang.github.io/2023/12/04/a3700r/TOTOlink%20A3700R%28setDiagnosisCfg%29/Exploit, Third Party Advisory
- https://815yang.github.io/2023/12/04/a3700r/TOTOlink%20A3700R%28setDiagnosisCfg%29/Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-50147?
There is an arbitrary command execution vulnerability in the setDiagnosisCfg function of the cstecgi .cgi of the TOTOlink A3700R router device in its firmware version V9.1.2u.5822_B20200513.
How severe is CVE-2023-50147?
CVE-2023-50147 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 1.18% probability of exploitation in the next 30 days.
How do I fix CVE-2023-50147?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-50128The remote keyless system of the Hozard alarm system (alarms…5.3
- CVE-2023-50129Missing encryption in the NFC tags of the Flient Smart Door …6.5
- CVE-2023-5013A vulnerability has been found in Pluck CMS 4.7.18 and class…5.4
- CVE-2023-50136Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 …5.4
- CVE-2023-50137JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) …5.4
- CVE-2023-5014A vulnerability was found in Sakshi2610 Food Ordering Websit…9.8
- CVE-2023-5015A vulnerability was found in UCMS 1.4.7. It has been classif…6.1
- CVE-2023-50159In ScaleFusion (Windows Desktop App) agent 10.5.2, Kiosk mod…8.8
- CVE-2023-5016A vulnerability was found in spider-flow up to 0.5.0. It has…9.8
- CVE-2023-50162SQL injection vulnerability in EmpireCMS v7.5, allows remote…7.2
- CVE-2023-50164An attacker can manipulate file upload params to enable path…9.8
- CVE-2023-50165Pega Platform versions 8.2.1 to Infinity 23.1.0 are affected…8.6
Are you affected by CVE-2023-50147?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST