Command Injection Vulnerability in Totolink X6000R AX3000
CVE-2024-1781

6.3MEDIUM

Key Information:

Vendor

Totolink
Status
X6000r Ax3000
Vendor
CVE Published:
23 February 2024

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-1781?

A command injection vulnerability exists in the Totolink X6000R AX3000 router, specifically in the function setWizardCfg located in the /cgi-bin/cstecgi.cgi file of the shttpd component. This flaw allows an attacker to execute arbitrary commands on the affected device, potentially leading to unauthorized access and control over the network infrastructure. The issue has become widely known following its public disclosure and presents a significant risk to users of this router model. It is crucial for administrators to address this vulnerability promptly to safeguard their systems from potential exploitation.

Affected Version(s)

X6000R AX3000 9.4.0cu.852_20230719

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-1781 - Proof of Concept

References

https://vuldb.com/?id.254573
vdb-entrytechnical-description
https://vuldb.com/?ctiid.254573
signaturepermissions-required
https://github.com/Icycu123/X6000R-AX3000-Wifi-6-Giga/blo...
exploit

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

.