Command Injection Vulnerability in Totolink X6000R AX3000
CVE-2024-1781
Key Information:
- Vendor
Totolink
- Status
- Vendor
- CVE Published:
- 23 February 2024
Badges
What is CVE-2024-1781?
A command injection vulnerability exists in the Totolink X6000R AX3000 router, specifically in the function setWizardCfg located in the /cgi-bin/cstecgi.cgi file of the shttpd component. This flaw allows an attacker to execute arbitrary commands on the affected device, potentially leading to unauthorized access and control over the network infrastructure. The issue has become widely known following its public disclosure and presents a significant risk to users of this router model. It is crucial for administrators to address this vulnerability promptly to safeguard their systems from potential exploitation.
Affected Version(s)
X6000R AX3000 9.4.0cu.852_20230719
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
EPSS Score
15% chance of being exploited in the next 30 days.
CVSS V3.1
CVSS V3.0
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published