CVE-2023-52041

CRITICAL

Published Jan 16, 2024 Modified Jun 17, 2025

Description

An issue discovered in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary code via the sub_410118 function of the shttpd program.

Is your site exposed to CVE-2023-52041?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
totolink	x6000r_firmware	All
totolink	x6000r	All

References

Exploits

https://kee02p.github.io/2024/01/13/CVE-2023-52041/ https://kee02p.github.io/2024/01/13/CVE-2023-52041/

Frequently Asked Questions

What is CVE-2023-52041? +

An issue discovered in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary code via the sub_410118 function of the shttpd program. It has a CVSS v3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2023-52041? +

CVE-2023-52041 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

What products are affected by CVE-2023-52041? +

CVE-2023-52041 affects products from totolink, specifically: x6000r, x6000r_firmware. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2023-52041? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-31178 9.8

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMaxAlive parameter to …

CVE-2026-31177 9.8

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMinAlive parameter to …

CVE-2026-31181 9.8

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunServerAddr parameter to …

CVE-2023-7220 9.8

A vulnerability was found in Totolink NR1800X 9.1.0u.6279_B20210910 and classified as critical. Affected by this issue is the function loginAuth …

CVE-2023-7221 9.8

A vulnerability was found in Totolink T6 4.1.9cu.5241_B20210923. It has been classified as critical. This affects the function main of …

CVE-2023-52031 9.8

TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the UploadFirmwareFile function.