CVE-2023-51035

Name of the Vulnerable Software and Affected Versions TOTOLINK EX1200L version 9.3.5u.6146 B20201023

Description The issue concerns the NTPSyncWithHost function in the cstecgi.cgi file of the TOTOLINK EX1200L router's firmware. It allows for arbitrary command execution due to the lack of proper sanitization of special elements used in the operating system command. This could enable a remote attacker to execute arbitrary code.

Recommendations For TOTOLINK EX1200L version 9.3.5u.6146 B20201023, consider disabling access to the "cstecgi.cgi" interface, specifically the NTPSyncWithHost function, until a patch is available. Restrict access to this interface to minimize the risk of exploitation. Avoid using the NTPSyncWithHost function in the affected API endpoint until the issue is resolved.