CVE-2023-48860

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-12-07 · updated 2026-06-17

Description

TOTOLINK N300RT version 3.2.4-B20180730.0906 has a post-authentication RCE due to incorrect access control, allows attackers can bypass front-end security restrictions and execute arbitrary code.

Affected products

TOTOLINK N300Rt Firmware: 3.2.4-b20180730.0906

References

https://github.com/xieqiang11/security_research/blob/main/TOTOLINK-N300RT-RCE.md
https://github.com/xieqiang11/security_research/blob/main/TOTOLINK-N300RT-RCE.md

Get alerted when CVE-2023-48860 or the next vulnerability affects your stack