CVE-2023-40042: totolink t10_v2_firmware Out-of-bounds Write
Vulnerability summary
CVE-2023-40042 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in totolink t10_v2_firmware. EPSS estimates a 1.54% chance of exploitation in the next 30 days, higher than 74.6% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Duplicates 1Timeline
- 08-08-2023PublishedVulnerability first disclosed.
- 10-10-2024Last modifiedVulnerability information updated.
Description
TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer overflow in setStaticDhcpConfig in /lib/cste_modules/lan.so. Attackers can send crafted data in an MQTT packet, via the comment parameter, to control the return address and execute code.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
1.54%
Chance of exploitation in the next 30 days
Percentile
75%
Versus all other CVEs
30-day change
Decrease -0.01 pp
From 1.55% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundIot Vuln
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Totolink1 product
- t10_v2_firmware5.9c.5061_b20200511
1 vendor · 1 product
References
3 links- www.totolink.cnNot Applicable
- github.com/Korey0sh1/IoT_vuln/blob/main/TOTOLINK/T10_V2/setStaticDhcpConfig.mdExploitThird Party Advisory