CVE-2023-46574: TOTOLINK A3700R firmware upload command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication and public exploit references makes this an urgent exposure despite the absence of KEV listing.

What it is

TOTOLINK A3700R firmware version 9.1.2u.6165_20211012 fails to sanitize the FileName parameter of the UploadFirmwareFile function, allowing command injection (CWE-77). Because the flaw is reachable over the network with no privileges or user interaction, it exposes the router to unauthenticated remote code execution.

Impact

An attacker can execute arbitrary commands on the device, gaining full control of the router with high impact to confidentiality, integrity and availability. This enables traffic interception, persistent implanting and use of the device as a pivot into the network.

Attack surface

Reached remotely over the network through the firmware upload interface, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is required according to the record.

Exploitation

No CISA KEV listing and no ransomware association, but EPSS is 0.65412 (99.2nd percentile) and both references are tagged Exploit, indicating public exploit material exists.

What to do

• Apply the vendor firmware fix for A3700R if available; the record does not name a patched version, so confirm with TOTOLINK.
• If no patch exists, restrict access to the router's management and firmware upload interface to trusted networks only.
• Disable remote administration and WAN-side management access on the device.
• Segment or replace the device if it cannot be patched, and monitor it as an untrusted endpoint.
• Change default credentials and audit for unauthorized configuration changes.

Detection

• Monitor router and upstream logs for POST requests to the firmware upload endpoint with suspicious FileName values containing shell metacharacters.
• Alert on unexpected outbound connections or new listening services originating from the router.
• Check firmware integrity and configuration hashes against a known-good baseline for signs of tampering.
• Watch for command-injection payload patterns (semicolons, pipes, backticks, $()) in HTTP parameters to the device.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.