PT-2023-19442 · Totolink · Totolink T8

Publicado 2023-01-16 · Atualizado 2025-03-26 · CVE-2023-24153

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TOTOLINK T8 version 4.1.5cu

Description A command injection issue in the version parameter of the recvSlaveCloudCheckStatus function allows attackers to execute arbitrary commands via a crafted MQTT packet.

Recommendations For TOTOLINK T8 version 4.1.5cu, consider disabling the recvSlaveCloudCheckStatus function until a patch is available to prevent exploitation. Restrict access to the version parameter in the affected function to minimize the risk of command injection.

Exploit

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

BDU:2025-10030

CVE-2023-24153

Produtos afetados

Totolink T8

Referências · 6

• 🔥 https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_t8/recvSlaveCloudCheckStatus_version/recvSlaveCloudCheckStatus.md · Exploit
• https://bdu.fstec.ru/vul/2025-10030 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-24153 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-24153 · Nota de Segurança
• https://t.me/cibsecurity/57452 · Publicação no Telegram
• https://t.me/cvenotify/116357 · Publicação no Telegram