Details of VAR-202310-1434

ID

VAR-202310-1434

CVE

CVE-2023-46547

TITLE

TOTOLINK X2000R GH formSysLog method buffer overflow vulnerability

Trust: 0.6

sources: CNVD: CNVD-2025-23607

DESCRIPTION

TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formSysLog. The TOTOLINK X2000R Gh is a WiFi 6 router released by China's TOTOLINK Electronics. It supports Gigabit networking and Easy Mesh functionality, enabling multi-device connectivity and wireless expansion. The TOTOLINK X2000R Gh suffers from a buffer overflow vulnerability caused by the formSysLog method's failure to properly validate the length of input data. An attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

Trust: 1.53

sources: NVD: CVE-2023-46547 // CNVD: CNVD-2025-23607 // VULMON: CVE-2023-46547

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-23607

AFFECTED PRODUCTS

vendor:	totolink	model:	x2000r	scope:	eq	version:	1.0.0-b20230221.0948	Trust: 1.0
vendor:	totolink	model:	x2000r gh 1.0.0-b20230221.0948.web	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2025-23607 // NVD: CVE-2023-46547

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2023-46547
value:	CRITICAL
Trust: 1.0
CNVD:	CNVD-2025-23607
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2025-23607
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2023-46547
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0

sources: CNVD: CNVD-2025-23607 // NVD: CVE-2023-46547

PROBLEMTYPE DATA

problemtype:

CWE-787

Trust: 1.0

sources: NVD: CVE-2023-46547

PATCH

title:

Patch for TOTOLINK X2000R GH formSysLog method buffer overflow vulnerability

url:

https://www.cnvd.org.cn/patchInfo/show/740986

Trust: 0.6

sources: CNVD: CNVD-2025-23607

EXTERNAL IDS

db:	NVD	id:	CVE-2023-46547	Trust: 1.7
db:	CNVD	id:	CNVD-2025-23607	Trust: 0.6
db:	VULMON	id:	CVE-2023-46547	Trust: 0.1

sources: CNVD: CNVD-2025-23607 // VULMON: CVE-2023-46547 // NVD: CVE-2023-46547

REFERENCES

url:	https://totolink.cn/home/menu/detail.html?menu_listtpl=download&id=85&ids=36	Trust: 1.1
url:	https://github.com/xyiym/digging/blob/main/totolink/x2000r/12/1.md	Trust: 1.1
url:	https://nvd.nist.gov/vuln/detail/cve-2023-46547	Trust: 0.6
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2025-23607 // VULMON: CVE-2023-46547 // NVD: CVE-2023-46547

SOURCES

db:	CNVD	id:	CNVD-2025-23607
db:	VULMON	id:	CVE-2023-46547
db:	NVD	id:	CVE-2023-46547

LAST UPDATE DATE

2025-10-15T23:41:00.257000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-23607	date:	2025-10-14T00:00:00
db:	VULMON	id:	CVE-2023-46547	date:	2023-10-25T00:00:00
db:	NVD	id:	CVE-2023-46547	date:	2023-11-01T18:00:59.353

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-23607	date:	2025-10-13T00:00:00
db:	VULMON	id:	CVE-2023-46547	date:	2023-10-25T00:00:00
db:	NVD	id:	CVE-2023-46547	date:	2023-10-25T18:17:38.960