Details of VAR-202310-1250

ID

VAR-202310-1250

CVE

CVE-2023-46551

TITLE

TOTOLINK X2000R GH formReflashClientTbl method buffer overflow vulnerability

Trust: 0.6

sources: CNVD: CNVD-2025-23728

DESCRIPTION

TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formReflashClientTbl. The TOTOLINK X2000R Gh is a WiFi 6 router released by China's TOTOLINK Electronics. It supports Gigabit networking and Easy Mesh functionality, offering multi-device connectivity and wireless expansion capabilities. The TOTOLINK X2000R Gh suffers from a buffer overflow vulnerability caused by the formReflashClientTbl method's failure to properly validate the length of input data. An attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

Trust: 1.53

sources: NVD: CVE-2023-46551 // CNVD: CNVD-2025-23728 // VULMON: CVE-2023-46551

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-23728

AFFECTED PRODUCTS

vendor:	totolink	model:	x2000r	scope:	eq	version:	1.0.0-b20230221.0948	Trust: 1.0
vendor:	totolink	model:	x2000r gh 1.0.0-b20230221.0948.web	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2025-23728 // NVD: CVE-2023-46551

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2023-46551
value:	CRITICAL
Trust: 1.0
CNVD:	CNVD-2025-23728
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2025-23728
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2023-46551
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0

sources: CNVD: CNVD-2025-23728 // NVD: CVE-2023-46551

PROBLEMTYPE DATA

problemtype:

CWE-787

Trust: 1.0

sources: NVD: CVE-2023-46551

PATCH

title:

Patch for TOTOLINK X2000R GH formReflashClientTbl method buffer overflow vulnerability

url:

https://www.cnvd.org.cn/patchInfo/show/740971

Trust: 0.6

sources: CNVD: CNVD-2025-23728

EXTERNAL IDS

db:	NVD	id:	CVE-2023-46551	Trust: 1.7
db:	CNVD	id:	CNVD-2025-23728	Trust: 0.6
db:	VULMON	id:	CVE-2023-46551	Trust: 0.1

sources: CNVD: CNVD-2025-23728 // VULMON: CVE-2023-46551 // NVD: CVE-2023-46551

REFERENCES

url:	https://totolink.cn/home/menu/detail.html?menu_listtpl=download&id=85&ids=36	Trust: 1.1
url:	https://github.com/xyiym/digging/blob/main/totolink/x2000r/2/1.md	Trust: 1.1
url:	https://nvd.nist.gov/vuln/detail/cve-2023-46551	Trust: 0.6
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2025-23728 // VULMON: CVE-2023-46551 // NVD: CVE-2023-46551

SOURCES

db:	CNVD	id:	CNVD-2025-23728
db:	VULMON	id:	CVE-2023-46551
db:	NVD	id:	CVE-2023-46551

LAST UPDATE DATE

2025-10-16T23:41:42.328000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-23728	date:	2025-10-15T00:00:00
db:	VULMON	id:	CVE-2023-46551	date:	2023-10-25T00:00:00
db:	NVD	id:	CVE-2023-46551	date:	2023-11-01T18:01:28.653

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-23728	date:	2025-10-13T00:00:00
db:	VULMON	id:	CVE-2023-46551	date:	2023-10-25T00:00:00
db:	NVD	id:	CVE-2023-46551	date:	2023-10-25T18:17:39.177