CVE-2023-51742 affects the Skyworth CM5100 router on firmware 4.1.1.24. Input to the Add Downstream Frequency field is not validated, and a logged in user can crash the device. The record rates it Medium at 6.5. CERT-In advises upgrading to firmware 4.1.1.25 or later.
What's affected
The record and the CERT-In advisory both name one product: the Skyworth CM5100 router (a cable modem router) running firmware 4.1.1.24. The CERT-In note says the fix is to upgrade to version 4.1.1.25 or later. The record does not list a fixed version of its own, so treat the CERT-In figure as the one to verify against Skyworth or your service provider.
The record gives a CVSS score of 6.5 (Medium). The CVSS vector reads as follows. The attack can be reached over the network, and the complexity is low. A low-privilege account is needed. No user interaction is required. Impact on confidentiality is none, on integrity none, and on availability high. The weakness class is CWE-787.
How to check if you're exposed
Log in to the device's own web interface from a trusted wired connection and read the firmware version on the status or system information page. If it says 4.1.1.24, you are on the affected build. If you manage many devices, pull the firmware field from your asset inventory or provisioning system instead of visiting each one.
This is a hardware and firmware issue, so a package scanner will not see it. If the router was supplied by an internet provider, the provider may control firmware updates, so ask them which version they have pushed.
What to do now
- Confirm the firmware version on every CM5100 you run or support.
- Upgrade to 4.1.1.25 or later, per the CERT-In advisory.
- Restrict who can reach the router's web interface. Keep it off the internet side and limit it to a management network or a single trusted host.
- Use a strong, unique administrator password, because this attack needs a logged in account.
- After updating, check that the device stays stable and report any crash to the vendor.
Why it matters
The record classifies the weakness as an out of bounds write. The web interface accepts a value for the Add Downstream Frequency parameter without checking it properly, and a crafted value can corrupt memory. The documented result is a denial of service, so the router stops working until it is restarted.
The score is Medium because the attacker needs a login. Low privilege is enough, but anonymous visitors are not able to use this path. That makes a strong administrator password and a closed management interface the practical defenses while you wait for the update.
Denial of service on a router is more than an annoyance. Every device behind it loses connectivity, and a flaw that can be triggered repeatedly can keep a site offline. If the router carries something time sensitive, treat the update as scheduled work rather than optional.
Quick check
Can anyone on the internet trigger this?
Not according to the record. It needs a logged in account with low privileges, and the interface should not be exposed to the internet anyway.
What is the worst outcome described?
A denial of service on the router. The record does not describe code execution or data theft for this CVE.
Sources
Last reviewed: 19 October 2026.
