CVE-2024-57014
Published: 15 January 2025
Description
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "recHour" parameter in setScheduleCfg.
Security Summary
CVE-2024-57014 is an OS command injection vulnerability (CWE-78) in the TOTOLINK X5000R router running firmware version V9.1.0cu.2350_B20230313. The issue resides in the setScheduleCfg function, where the "recHour" parameter fails to properly sanitize user input, allowing arbitrary OS command execution.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility with low attack complexity. It requires low privileges (PR:L) and no user interaction, enabling authenticated remote attackers to inject and execute commands with high impacts on confidentiality, integrity, and availability, potentially resulting in full device compromise.
Technical details are documented in a GitHub repository at https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setScheduleCfg/setScheduleCfg.md. The vendor website at https://www.totolink.net/ serves as a reference for potential advisories or patches.
Details
- CWE(s)