Security readout for executives and security teams
Plain-English summary
CVE-2023-37146 describes a command injection issue in TOTOLINK LR350 firmware version V9.3.5u.6369_B20220309. The reported vulnerable area is firmware upload handling. If exploitable by an attacker with access to that function, it could allow router-level command execution. The public record does not provide severity, CVSS, vendor fix, or active exploitation evidence.
Executive priority
Treat this as an exposure discovery and containment item, not a confirmed emergency. Prioritize any internet-facing or remotely administered TOTOLINK LR350 devices because command injection in router firmware handling can create broad network risk.
Technical view
The CVE states that the FileName parameter in the UploadFirmwareFile function is vulnerable to command injection on TOTOLINK LR350 V9.3.5u.6369_B20220309. Available sources do not list CWE, CVSS, authentication requirements, exploit prerequisites, patch status, or vendor-confirmed remediation.
Likely exposure
Exposure is most likely limited to organizations running the specified TOTOLINK LR350 firmware. Risk increases if the router management or firmware upload interface is reachable from untrusted networks.
Exploitation context
The CVE is not listed in KEV, and the provided sources do not claim active exploitation. A public GitHub reference exists, but the bundle does not provide enough detail to assess real-world exploitation or reliability.
Researcher notes
Evidence is thin. The key confirmed facts are product, firmware version, vulnerable function, and parameter. No CVSS, CWE, patch, authentication context, or active exploitation evidence is present in the supplied bundle.
Mitigation direction
- Inventory TOTOLINK LR350 devices and confirm firmware versions.
- Check TOTOLINK guidance for a fixed firmware or official mitigation.
- Restrict router management access to trusted administrative networks.
- Remove internet exposure for administrative and firmware upload interfaces.
- Retire or replace affected devices if no supported fix exists.
Validation and detection
- Confirm whether LR350 V9.3.5u.6369_B20220309 is deployed.
- Review external exposure of router management interfaces.
- Verify firmware upload functions require trusted administrative access only.
- Check logs for unexpected firmware upload or configuration activity.
- Monitor CVE and vendor sources for patch or exploitation updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-37146 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/DaDong-G/Vulnerability_info/tree/main/TOTOLINK/lr350/2CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.