CVE-2023-41011: Critical RCE in China Mobile Gateway

Critical RCE (CVSS 9.8) in China Mobile HG6543C4 via shortcut_telnet.cg; recent evidence of public exploit.

CVE-2023-41011 is a remote code execution in the shortcut_telnet.cg component of China Mobile HG6543C4 gateway. An unauthenticated remote attacker can execute commands with system privileges. Since the gateway controls smart home infrastructure, the impact extends across the entire connected network.

CVSS 9.8 (critical). Published September 14, 2023, but on October 30, 2026 public GitHub repositories declare working exploits. This signal indicates a concretely higher risk for administrators managing these devices.

Contact China Mobile support for official patches; if unavailable, disable shortcut_telnet or filter Internet access. Implement network microsegmentation, isolation from critical systems, logging and monitoring. Catalog all corporate HG6543C4 devices and include this CVE in weekly patch management plans.

At a glance

What: Remote arbitrary code execution in the shortcut_telnet.cg component of China Mobile Intelligent Home Gateway model HG6543C4
Severity: CVSS 9.8 (critical) - allows unauthorized code execution with remote access
Affected versions: China Mobile Intelligent Home Gateway v.HG6543C4
Fix: Not reported
Status: CVE published 2023-09-14; recent signals (2026-10-30) indicate public repositories on GitHub claiming to contain exploits
Action: Check vendor for patch availability; isolate exposed devices from critical networks; monitor access to shortcut_telnet.cg component

Sources: NVD, CVE-2023-41011

← All articles