CVE-2023-52030

The vulnerability is located in the setOpModeCfg function in the Totolink A3700R router software. An attacker can send a specially crafted network request to the device, which will be processed by the vulnerable function without permission verification. As a result, it is possible to execute arbitrary system commands on the device (RCE). The attack vector is network-based, does not require user interaction or any privileges.

An attacker can gain full control over the device, including reading and modifying its configuration, intercepting network traffic, and using the device as an entry point for further network actions (lateral movement). The vulnerability provides the attacker with complete access to the confidentiality, integrity, and availability of the system.

Patches available from the manufacturer should be applied according to the references. If an update is not available, it is recommended to restrict access to the device management interface exclusively to trusted IP addresses and isolate the device from direct access from the Internet.

Totolink A3700R with software version v9.1.2u.5822_B20200513