PT-2024-35418 · Totolink · Totolink X6000R

M4Rg4Tr01D · Published 2024-11-22 · Updated 2024-12-16 · CVE-2024-52723

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK X6000R version 9.4.0cu.1041 B20240224

Description The issue arises from the use of the Uci Set function without strict parameter filtering in the shttpd file. This allows an attacker to achieve arbitrary command execution by constructing a specific payload.

Recommendations For TOTOLINK X6000R version 9.4.0cu.1041 B20240224, consider disabling the Uci Set function until a patch is available to prevent arbitrary command execution. Restrict access to the shttpd file to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-52723

Affected Products

Totolink X6000R

References · 5

• https://osv.dev/vulnerability/CVE-2024-52723 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52723 · Security Note
• https://gist.github.com/M4rg4tr01d/e84f8ed8dc27960d7c56ad289f6fb0ff · Note
• https://twitter.com/CVEnew/status/1859995420669161901 · Twitter Post
• http://x6000r.com · Note