Command Injection Vulnerability in Totolink X6000R AX3000

CVE-2024-1781

Summary

A command injection vulnerability exists in the Totolink X6000R AX3000 router, specifically in the function setWizardCfg located in the /cgi-bin/cstecgi.cgi file of the shttpd component. This flaw allows an attacker to execute arbitrary commands on the affected device, potentially leading to unauthorized access and control over the network infrastructure. The issue has become widely known following its public disclosure and presents a significant risk to users of this router model. It is crucial for administrators to address this vulnerability promptly to safeguard their systems from potential exploitation.

References