Command Injection Vulnerability in TOTOLINK CP900L

CVE-2024-35401

Summary

The TOTOLINK CP900L device has a vulnerability that permits command injection through the FileName parameter in the UploadFirmwareFile function. This flaw could be exploited to execute arbitrary commands, potentially compromising network security and integrity. Such vulnerabilities are critical to address to maintain robust defenses against unauthorized access and exploitation in IoT environments.

References