CVE-2023-2790: TOTOLINK N200RE Telnet Service custom.conf password in configuration file
Vulnerability summary
CVE-2023-2790 is a medium (CVSS 5.5) Password in Configuration File vulnerability in totolink n200re_firmware. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 19% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 18-05-2023PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability classified as problematic has been found in TOTOLINK N200RE 9.3.5u.6255_B20211224. Affected is an unknown function of the file /squashfs-root/etc_ro/custom.conf of the component Telnet Service. The manipulation leads to password in configuration file. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. VDB-229374 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS metrics
5 scores · 2 sources · 3 versions- CVE.orgCNA2.3LowCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NDiffers
- NVDNIST1.4LowAV:L/AC:L/Au:M/C:P/I:N/A:N
EPSS trend
Probability
0.28%
Chance of exploitation in the next 30 days
Percentile
19%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.28% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (drive.google.com)
Maturity: unknown
Exploit Reference (vuldb.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Totolink1 product
- n200re_firmware9.3.5u.6255_B20211224 | 9.3.5u.6255_b20211224
1 vendor · 1 product
References
3 links- drive.google.com/file/d/1RITXRvKele5aW42YFk0JeQHCq2B63lUj/view?usp=share_linkExploitThird Party Advisory