Cyber Posture

CVE-2024-57014

HighPublic PoC

Published: 15 January 2025

Published
15 January 2025
Modified
18 March 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0190 83.3th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Description

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "recHour" parameter in setScheduleCfg.

Security Summary

CVE-2024-57014 is an OS command injection vulnerability (CWE-78) in the TOTOLINK X5000R router running firmware version V9.1.0cu.2350_B20230313. The issue resides in the setScheduleCfg function, where the "recHour" parameter fails to properly sanitize user input, allowing arbitrary OS command execution.

The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility with low attack complexity. It requires low privileges (PR:L) and no user interaction, enabling authenticated remote attackers to inject and execute commands with high impacts on confidentiality, integrity, and availability, potentially resulting in full device compromise.

Technical details are documented in a GitHub repository at https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setScheduleCfg/setScheduleCfg.md. The vendor website at https://www.totolink.net/ serves as a reference for potential advisories or patches.

Details

CWE(s)
CWE-78

Affected Products

totolink
x5000r firmware
9.1.0cu.2350_b20230313

References