CVE-2023-49254 is a high severity flaw, scored 8.8, in the Hongdian H8951-4G-ESP router: an authenticated user can run commands as root through the destination field of the network test tools. Builds before 2310271149 are affected. Update to build 2310271149 or later.
What's affected
The record says an authenticated user can run arbitrary commands as root by supplying input in the destination field of the network test tools. It notes the issue is similar to CVE-2021-28151, which was handled in the interface by blocking characters with JavaScript, yet the weakness remains when requests are sent directly. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Hongdian's fix is build 2310271149. CERT Polska's advisory says all builds before 2310271149 are affected, that the vendor removed the vulnerabilities in that build, and that the reporter confirmed the fix.
How to check if you're exposed
The advisory gives the cutoff as a firmware build number, so the job is to read the build off the device. Sign in to the router's management page and look at the system or firmware information screen. The exact menu name can differ, so use the vendor's documentation if you cannot find it. Compare what you see with 2310271149.
If you manage many units, record the build for each one in your asset list. Anything earlier than 2310271149 is in the affected range. There is no package manager command for this, because the software ships as part of the device firmware.
What to do now
- List every Hongdian H8951-4G-ESP router you run and read its firmware build.
- Update any unit earlier than build 2310271149 using the firmware from Hongdian. The CERT Polska advisory lists no workarounds, so the update is the remedy.
- Take the management interface off the public internet and off untrusted networks while you work through the fleet.
- Change credentials and any passwords stored in router configuration backups after the update, since several of these issues involve exposed credentials or secrets.
- Add the model to your inventory so future advisories match it automatically.
Why it matters
This is OS command injection, CWE-78. The input from a diagnostic form ends up in a command the operating system runs. The earlier fix only filtered in the browser, and a filter in client side script does not bind anyone who talks to the server directly.
The lesson applies beyond routers. Validation has to happen on the server that acts on the input, because the client is under the control of whoever is sending the request. An attacker needs a valid login here, which lowers the score from critical to high, but the router holds the credentials, which makes a login easier to come by than it sounds, as other CVEs in the same advisory show.
This CVE is one of ten that CERT Polska published together for the same router on 12 January 2024. Patching for one means patching for all of them, which is why the single fixed build matters more than any individual score.
Quick check
Why is this rated lower than the hardcoded password issue?
It requires an authenticated user, shown as PR:L in the vector. The hardcoded password issue needs no privileges, so it scores 9.8 against 8.8 here.
Does the advisory offer a workaround instead of the update?
No. The CERT Polska page lists no workarounds and names the update to build 2310271149 or later as the remedy.
Sources
CERT Polska: Hongdian H8951-4G-ESP, CVE-2023-49253 to CVE-2023-49262
Last reviewed: 19 October 2026.
