CVE-2023-41011

Think of this like a home gateway that has a secret backdoor built into one of its settings pages — anyone on the internet who knows about it can walk in and take full control of the device without needing a key or password. From there they could spy on your internet traffic, disrupt your connection, or use your device as a stepping stone to attack other things on your network.

This matters to you if your business uses a China Mobile Intelligent Home Gateway, specifically model HG6543C4, for internet or network access. The flaw is reachable remotely and requires no login, so any device with its management interface exposed to the internet is at risk.

This is a critical, red-alert situation: there is public exploit code already available, and sustained press coverage indicates active exploitation of this flaw in the wild. With no vendor patch currently available, exposed devices should be isolated or taken offline now rather than waiting for a fix.

Confirm exposure by identifying all China Mobile Intelligent Home Gateway HG6543C4 units in your network and checking whether their management/telnet interfaces (including the shortcut_telnet.cg endpoint) are reachable from the WAN or internet. No fixed firmware version has been published by the vendor at this time, so there is no upgrade path to recommend yet. As a temporary workaround: disable remote administration, restrict access to the management interface to trusted internal IPs only, place the device behind a firewall that blocks inbound telnet/HTTP management ports, and consider replacing the device with alternate hardware if it provides internet-facing critical services. This CVE is not currently listed in CISA's Known Exploited Vulnerabilities catalog, so there is no federal remediation deadline, but monitor for vendor advisories and for the device's inclusion in KEV, and watch network logs for unexpected telnet/shell activity or connections to shortcut_telnet.cg from unfamiliar sources.

CVSS 3.1 score 9.8 (Critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicating network-exploitable, low-complexity, no privileges or user interaction required, with full impact to confidentiality, integrity, and availability. Weakness class is CWE-77 (OS command injection) via the shortcut_telnet.cg component. One public proof-of-concept exploit exists on GitHub, and sustained press attention reports active exploitation, though the CVE is not yet listed in CISA KEV. EPSS scoring places predicted exploitation likelihood in the 85th percentile with a falling trend, but given confirmed exploitation reporting, that predictive signal is secondary to the observed exploitation activity. No vendor patch is currently available.