Details of VAR-202310-1070

ID

VAR-202310-1070

CVE

CVE-2023-46546

TITLE

TOTOLINK X2000R Gh formStats method buffer overflow vulnerability

Trust: 0.6

sources: CNVD: CNVD-2025-23730

DESCRIPTION

TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formStats. The TOTOLINK X2000R Gh is a WiFi 6 router released by China's TOTOLINK Electronics. It supports Gigabit networking and Easy Mesh functionality, offering multi-device connectivity and wireless expansion capabilities. The TOTOLINK X2000R Gh suffers from a buffer overflow vulnerability caused by the formStats method's failure to properly validate the length of input data. An attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

Trust: 1.53

sources: NVD: CVE-2023-46546 // CNVD: CNVD-2025-23730 // VULMON: CVE-2023-46546

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-23730

AFFECTED PRODUCTS

vendor:	totolink	model:	x2000r	scope:	eq	version:	1.0.0-b20230221.0948	Trust: 1.0
vendor:	totolink	model:	x2000r gh 1.0.0-b20230221.0948.web	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2025-23730 // NVD: CVE-2023-46546

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2023-46546
value:	CRITICAL
Trust: 1.0
CNVD:	CNVD-2025-23730
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2025-23730
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2023-46546
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0

sources: CNVD: CNVD-2025-23730 // NVD: CVE-2023-46546

PROBLEMTYPE DATA

problemtype:

CWE-787

Trust: 1.0

sources: NVD: CVE-2023-46546

PATCH

title:

Patch for TOTOLINK X2000R Gh formStats method buffer overflow vulnerability

url:

https://www.cnvd.org.cn/patchInfo/show/740981

Trust: 0.6

sources: CNVD: CNVD-2025-23730

EXTERNAL IDS

db:	NVD	id:	CVE-2023-46546	Trust: 1.7
db:	CNVD	id:	CNVD-2025-23730	Trust: 0.6
db:	VULMON	id:	CVE-2023-46546	Trust: 0.1

sources: CNVD: CNVD-2025-23730 // VULMON: CVE-2023-46546 // NVD: CVE-2023-46546

REFERENCES

url:	https://github.com/xyiym/digging/blob/main/totolink/x2000r/15/1.md	Trust: 1.7
url:	https://totolink.cn/home/menu/detail.html?menu_listtpl=download&id=85&ids=36	Trust: 1.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2025-23730 // VULMON: CVE-2023-46546 // NVD: CVE-2023-46546

SOURCES

db:	CNVD	id:	CNVD-2025-23730
db:	VULMON	id:	CVE-2023-46546
db:	NVD	id:	CVE-2023-46546

LAST UPDATE DATE

2025-10-16T23:42:10.589000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-23730	date:	2025-10-15T00:00:00
db:	VULMON	id:	CVE-2023-46546	date:	2023-10-25T00:00:00
db:	NVD	id:	CVE-2023-46546	date:	2023-11-01T18:01:11.127

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-23730	date:	2025-10-13T00:00:00
db:	VULMON	id:	CVE-2023-46546	date:	2023-10-25T00:00:00
db:	NVD	id:	CVE-2023-46546	date:	2023-10-25T18:17:38.917