CVE-2023-46574

What it actually does

CVE-2023-46574 is an unauthenticated command injection vulnerability in TOTOLINK A3700R firmware version 9.1.2u.6165_20211012. The firmware upload handler, UploadFirmwareFile, improperly handles attacker-controlled input in the FileName parameter, allowing shell metacharacters or command strings to be interpreted by the underlying operating system. Because the device management service typically runs with high privileges on embedded routers, successful exploitation can allow arbitrary command execution, full device takeover, configuration theft, traffic interception, persistence, botnet enrollment, or denial of service.

Why it matters to the business

An exposed vulnerable router can be remotely taken over without credentials, which can disrupt connectivity, provide attackers a foothold inside the network, enable interception or redirection of traffic, and support attacks against other organizations. The vulnerability has a critical CVSS score of 9.8, a high EPSS probability of exploitation, and weaponized exploit maturity, so organizations should treat internet-exposed A3700R devices as high-risk even though this issue is not currently listed in CISA KEV and is not specifically flagged as ransomware-associated.

How an attack unfolds

An attacker first identifies TOTOLINK A3700R devices with reachable web management interfaces, commonly by internet scanning or probing known router administration endpoints. The attacker then sends a crafted HTTP request to the firmware upload function and places shell syntax in the FileName parameter. Because the firmware does not safely validate or escape that parameter before using it in an operating-system command, the injected command executes on the router. After initial code execution, the attacker can run reconnaissance commands, download a payload using BusyBox utilities such as wget, curl, or tftp, modify startup scripts or configuration for persistence, change DNS or routing settings, add firewall/NAT rules, proxy traffic, or enroll the device into a botnet. Compromised routers may then be used for credential theft, lateral movement support, traffic manipulation, DDoS activity, or further scanning and exploitation.

How to fix it

No fixed version was provided in the supplied data. Organizations should check TOTOLINK advisories and support channels for updated A3700R firmware that explicitly addresses this vulnerability and apply it immediately if available. If no vendor-fixed firmware is available, remove or replace affected A3700R devices, especially if reachable from the internet or untrusted networks. As compensating controls, disable remote web administration from the WAN, restrict management access to a dedicated trusted network or VPN, enforce firewall ACLs that allow administration only from known administrator IP addresses, block external access to router administration ports, and monitor for attempts to access UploadFirmwareFile. For devices suspected of compromise, preserve evidence where required, disconnect from untrusted networks, reflash firmware from a trusted source, reset to factory defaults, rotate administrative credentials, review DNS/routing/firewall settings, and consider replacement if integrity cannot be assured.

How to confirm the fix worked

Confirm whether any TOTOLINK A3700R devices are running firmware version 9.1.2u.6165_20211012 by checking the administrative UI, firmware inventory tools, device labels combined with firmware records, or authenticated management interfaces. Validate that the management interface is not reachable from the internet or untrusted VLANs using external scanning and internal segmentation testing. If a vendor update is applied, verify the installed firmware version and review release notes for an explicit fix to the UploadFirmwareFile/FileName command injection issue. Where safe and authorized, perform a non-destructive validation by sending a benign request containing shell metacharacters in the FileName parameter and confirming that input is rejected, sanitized, or not executed. Also confirm that firewall rules restrict access to management services and that router configuration, DNS servers, port forwards, startup scripts, and scheduled jobs have not been unexpectedly modified.

Typical attack path

1. Scan the internet or local network for TOTOLINK A3700R router management interfaces.
2. Fingerprint the device model and firmware version, looking for version 9.1.2u.6165_20211012 or similar vulnerable builds.
3. Send a crafted request to the UploadFirmwareFile function with command syntax embedded in the FileName parameter.
4. Achieve arbitrary command execution through the router web process.
5. Execute basic discovery commands and verify outbound network access from the device.
6. Download and execute a second-stage payload, often under /tmp on embedded Linux systems.
7. Modify configuration, DNS, firewall, routing, cron, init, or startup locations to maintain control.
8. Use the compromised router for proxying, scanning, traffic interception, DDoS, or additional intrusions.

How to detect it

Review router administrative logs, embedded web server logs, upstream firewall logs, reverse proxy logs if present, IDS/IPS alerts, NetFlow, and DNS logs for requests to the firmware upload function with suspicious FileName values. Focus on POST requests that reference UploadFirmwareFile and contain shell metacharacters such as semicolons, pipes, backticks, $(), redirection operators, URL-encoded command separators, or commands such as wget, curl, tftp, nc, sh, chmod, busybox, or rm. Investigate outbound connections from routers shortly after such requests, especially to unfamiliar IP addresses, dynamic DNS domains, high-risk hosting providers, or ports commonly used for payload staging. On devices with shell access or forensic images, look for unexpected files in /tmp, /var/tmp, /dev/shm, or writable configuration areas; suspicious startup modifications; unauthorized DNS, firewall, routing, port-forwarding, or administrative password changes; and processes consistent with botnet malware or reverse shells. Because router logging may be limited or volatile, correlate edge firewall logs, DHCP leases, DNS telemetry, and traffic captures to reconstruct activity around the suspected exploitation window.

• UploadFirmwareFile
• FileName=
• "topicurl":"UploadFirmwareFile"
• topicurl=UploadFirmwareFile
• FileName=%3B
• FileName=;
• FileName=%7C
• FileName=|
• FileName=%60
• FileName=`
• FileName=$(
• FileName=%24%28
• FileName=*wget*
• FileName=*curl*
• FileName=*tftp*
• FileName=*busybox*
• FileName=*chmod*
• FileName=*/tmp/*
• POST *UploadFirmwareFile*
• /tmp/
• /var/tmp/
• /dev/shm/
• wget http://
• curl http://
• tftp -g
• chmod +x /tmp
• busybox wget
• /bin/sh -c

What your security team should do

• Immediately inventory TOTOLINK A3700R devices and identify any running firmware version 9.1.2u.6165_20211012.
• Prioritize remediation for any device whose management interface is reachable from the internet or from untrusted internal networks.
• If no fixed firmware is available from TOTOLINK, replace the affected router or remove it from production use.
• Disable WAN-side administration and restrict management access to VPN or a dedicated administrator network only.
• Block and alert on HTTP requests to UploadFirmwareFile, especially requests containing FileName values with shell metacharacters or downloader commands.
• Review router logs, upstream firewall logs, proxy logs, and NetFlow for exploitation attempts and suspicious outbound connections from affected devices.
• For potentially exposed devices, assume possible compromise: reflash or factory reset, rotate administrative passwords, and verify DNS, routing, firewall, and port-forwarding settings.
• Add detection coverage for embedded Linux post-exploitation behavior such as wget, curl, tftp, chmod, sh, and execution from /tmp.
• Monitor threat intelligence for newly published fixed firmware, proof-of-concept changes, botnet campaigns, or inclusion in CISA KEV.