Details of VAR-202310-1212

ID

VAR-202310-1212

CVE

CVE-2023-46549

TITLE

TOTOLINK X2000R Gh formSetLg method buffer overflow vulnerability

Trust: 0.6

sources: CNVD: CNVD-2025-23729

DESCRIPTION

TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formSetLg. The TOTOLINK X2000R Gh is a WiFi 6 router released by China's TOTOLINK Electronics. It supports Gigabit networking and Easy Mesh functionality, offering multi-device connectivity and wireless expansion capabilities. The TOTOLINK X2000R Gh suffers from a buffer overflow vulnerability caused by the formSetLg method's failure to properly validate the length of input data. An attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

Trust: 1.53

sources: NVD: CVE-2023-46549 // CNVD: CNVD-2025-23729 // VULMON: CVE-2023-46549

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-23729

AFFECTED PRODUCTS

vendor:	totolink	model:	x2000r	scope:	eq	version:	1.0.0-b20230221.0948	Trust: 1.0
vendor:	totolink	model:	x2000r gh 1.0.0-b20230221.0948.web	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2025-23729 // NVD: CVE-2023-46549

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2023-46549
value:	CRITICAL
Trust: 1.0
CNVD:	CNVD-2025-23729
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2025-23729
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2023-46549
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0

sources: CNVD: CNVD-2025-23729 // NVD: CVE-2023-46549

PROBLEMTYPE DATA

problemtype:

CWE-787

Trust: 1.0

sources: NVD: CVE-2023-46549

PATCH

title:

Patch for TOTOLINK X2000R Gh formSetLg method buffer overflow vulnerability

url:

https://www.cnvd.org.cn/patchInfo/show/740976

Trust: 0.6

sources: CNVD: CNVD-2025-23729

EXTERNAL IDS

db:	NVD	id:	CVE-2023-46549	Trust: 1.7
db:	CNVD	id:	CNVD-2025-23729	Trust: 0.6
db:	VULMON	id:	CVE-2023-46549	Trust: 0.1

sources: CNVD: CNVD-2025-23729 // VULMON: CVE-2023-46549 // NVD: CVE-2023-46549

REFERENCES

url:	https://github.com/xyiym/digging/blob/main/totolink/x2000r/18/1.md	Trust: 1.7
url:	https://totolink.cn/home/menu/detail.html?menu_listtpl=download&id=85&ids=36	Trust: 1.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2025-23729 // VULMON: CVE-2023-46549 // NVD: CVE-2023-46549

SOURCES

db:	CNVD	id:	CNVD-2025-23729
db:	VULMON	id:	CVE-2023-46549
db:	NVD	id:	CVE-2023-46549

LAST UPDATE DATE

2025-10-16T23:45:33.710000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-23729	date:	2025-10-15T00:00:00
db:	VULMON	id:	CVE-2023-46549	date:	2023-10-25T00:00:00
db:	NVD	id:	CVE-2023-46549	date:	2023-11-01T18:02:10.380

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-23729	date:	2025-10-13T00:00:00
db:	VULMON	id:	CVE-2023-46549	date:	2023-10-25T00:00:00
db:	NVD	id:	CVE-2023-46549	date:	2023-10-25T18:17:39.080